Questions tagged [yubikey]
YubiKey is an USB authentication key developed by Yubico.
1
vote
0answers
11 views
Does the output of --export-ssh-key change with different subkeys?
I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
1
vote
0answers
27 views
PGP With 2 x Yuibikey 4 + 1 USB (Backup)
I have 2 Yubikey 4.
I'd like to use them for PGP and overall for securing my online identity.
I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
1
vote
1answer
50 views
Why can GPG sign messages but not keys?
I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
1
vote
0answers
115 views
GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard
I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors:
x>gpg -vv --decrypt encrypted.gpg
gpg: armor: BEGIN PGP MESSAGE
# off=0 ctb=XX ...
0
votes
1answer
91 views
KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password
Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know:
Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password?
From what I know, the ...
0
votes
0answers
20 views
Authentication implications for a mapped PIV certificate
I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on.
Some of the devices I've looked ...
2
votes
0answers
69 views
yubikey creating different ssh public key having same GPG
I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
0
votes
1answer
74 views
Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?
Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
1
vote
1answer
219 views
Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?
I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
0
votes
0answers
100 views
Can Yubikey complement a TPM chip?
Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other?
Although I assume an external key ...
2
votes
4answers
242 views
Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?
I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead.
I try to store all data local and use seldom cloud based services.
If ...
0
votes
1answer
66 views
Deterministic password generation using Yubikey
I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey ...
3
votes
1answer
203 views
Signing/certifying keys as a YubiKey user
After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys.
I was surprised to learn that one can only sign keys using ...
0
votes
1answer
86 views
How to force GPG to use a Keycard when it is available
I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
8
votes
4answers
2k views
Create backup Yubikey with identical PGP keys
I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
0
votes
0answers
54 views
Which logon method is better, PIV-based or HMAC-SHA1 challenge-response?
I use macOS 10.13.3 with PIV smart-cards support and Yubikey-4. The key provides not only PIV functionality but also Challenge-Response HMAC-SHA1. The OS can be configured to require the latter for ...
5
votes
1answer
216 views
Yubikey Desktop Authenticator
Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator?
Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
0
votes
1answer
99 views
How to use master password for GPG encryption after setting up Yubikey? [closed]
I just setup my Yubikey 4 on Windows. How can I use master password for signing/encrypting when I don't have my key?
If the yubikey is not inserted I get an error "Please insert the card with serial ...
2
votes
1answer
973 views
Does Yubikey 4 support multiple OpenPGP encryption keys or only one?
When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
1
vote
0answers
192 views
Weighing options for personal HSM?
I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
3
votes
1answer
1k views
Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey
I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
2
votes
1answer
1k views
GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]
I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
3
votes
2answers
446 views
Encryption using multiple Yubikeys, any of which can unlock
I was hoping to use my Yubikey for file encryption, but also wanted to have a backup Yubikey work to unlock the file.
From a conceptual point of view, I know it is possible since, even as is, I ...
1
vote
0answers
583 views
How do security properties of Trezor's FIDO U2F differ from Yubikey?
Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey:
The keys are always generated on the device and never rely on the manufacturer ...
4
votes
2answers
274 views
Security benefit of hardware backed host keys for OpenSSH
There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them.
This got me thinking about things to do with them, more or less useful. Of course I already use ...
1
vote
0answers
76 views
Are all the FIDO U2F tools from Yubico cross-compatible
So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
1
vote
1answer
487 views
Can I generate and store keys on my Yubico?
Its a simple question but there's no answer in the Yubico's website
When I recive a Yubico (from the Yubico 4 series), I know I can sign code, for example. But how is the key inside it generated? Is ...
4
votes
1answer
121 views
Finding out the password or bypass Linux password for home encryption?
I forgot the password of one of my account on Ubuntu 16.04.
The user account directory is encrypted.
I have configured the Yubikey SSH key based login so I am able to login, into that account. But ...
3
votes
2answers
1k views
How to use YubiKey through GnuPG on remote server?
I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
0
votes
2answers
239 views
Would it be possible to store Kerberos tickets on a YubiKey?
Kerberos supports different ways (ccache types) of storing tickets, such as:
FILE
MEMORY
KEYRING
I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
2
votes
0answers
221 views
Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate
I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized:
$ lsusb
...
Bus 001 Device 005: ID 1050:0407 Yubico.com
...
However, ...
4
votes
2answers
401 views
Why aren't hardware SSH keys the default access for production systems?
In the Bitcoin world I see people using hardware key stores (and hardware signing devices) as the de-facto only secure way of storing and transmitting $M values.
Wouldn't a hardware SSH keystore be ...
10
votes
1answer
2k views
GPG encryption subkey on multiple smart cards issue
Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards?
My (simplified) setup is as follows:
Generated a master key ...
2
votes
2answers
188 views
How does concatenating a user password and a YubiKey OTP work?
I use a Yubikey to log in to a VPN. When logging in, I supply a username, and then type a password, and without hitting return, touch the Yubikey.
As far as I understand, and from experimenting, the ...
2
votes
1answer
402 views
In the context of FIDO U2F, when is a new ephemeral key reused, or cached?
I'm reading this paper from Yubico on Universal Second Factor
and OpenID Connect and see the description about ephemeral keys
I'm confused on when a ephemeral key is used, and under what conditions ...
4
votes
1answer
1k views
How secure is Google’s/Android’s Smart Lock functionality?
Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
8
votes
3answers
623 views
Is it safe to publish public PGP authentication subkeys?
Suppose I have a PGP key set up as follows:
I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys.
Then I create three ...
0
votes
1answer
991 views
Security of KeePass and Yubikey OATH-HOTP
How secure is KeePass in addition with a Yubikey with OATH-HOTP?
I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor.
But ...
9
votes
1answer
286 views
Pin required for accessing (smartcard) Card Authentication Slot
So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple ...
1
vote
1answer
199 views
Yubikey for signing efi images, could not find token
I am trying to sign an efi image with a Yubikey 4
I configured Yubikey with the following:
yubico-piv-tool -k $key -a import-key -s 9c < test-key.rsa
yubico-piv-tool -k $key -a import-certificate ...
1
vote
1answer
694 views
Why do I get a warning when specifying the recipient for signing a document?
I just got a Yubikey 4 and I generate the key with gpg2 --card-edit and now I have this:
$ gpg2 --list-key
/home/lilas/.gnupg/pubring.kbx
------------------------------
pub rsa2048/EA3829E3 2016-11-...
1
vote
1answer
238 views
Is a yubikey with OpenPGP applet more secure then saving the private key in a encrypted USB stick?
If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11.
But what is the point of using a Yubikey with ...
2
votes
2answers
211 views
Does YubiKey with LastPass influence encryption?
I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the ...
1
vote
1answer
633 views
Is YubiKey vulnerable to BadUSB exploits?
I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated ...
-3
votes
1answer
702 views
How secure is using a Yubikey to unlock a MacBook Pro with Filevault?
I just got a MacBook and am planning on using it with Filevault and a Firmware password. How secure would using a new Yubikey be while using it to login using the standard method if the computer gets ...
5
votes
1answer
538 views
How to manage employee OpenPGP keys?
I am trying to create a secured policy for storing and maintaining keys between users of my company.
I am rather new to OpenPGP and thus need some advice.
Currently, the idea is:
Generate a master ...
4
votes
1answer
753 views
Yubikey with gpg2
I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
8
votes
1answer
842 views
Is the OpenPGP implementation of the YubiKey 4 Open Source?
Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
5
votes
1answer
1k views
uploading pkcs12 to yubikey piv slot
i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
4
votes
1answer
2k views
Relative merits of Yubico OTP vs. OATH-HOTP?
What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
