Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

How secure is Google’s/Android’s Smart Lock functionality?

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
2
votes
0answers
787 views

How do security properties of Trezor's FIDO U2F differ from Yubikey?

Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey: The keys are always generated on the device and never rely on the manufacturer ...
9
votes
3answers
5k views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
4
votes
2answers
308 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
1
vote
0answers
84 views

Are all the FIDO U2F tools from Yubico cross-compatible

So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
1
vote
1answer
897 views

Can I generate and store keys on my Yubico?

Its a simple question but there's no answer in the Yubico's website When I recive a Yubico (from the Yubico 4 series), I know I can sign code, for example. But how is the key inside it generated? Is ...
4
votes
1answer
138 views

Finding out the password or bypass Linux password for home encryption?

I forgot the password of one of my account on Ubuntu 16.04. The user account directory is encrypted. I have configured the Yubikey SSH key based login so I am able to login, into that account. But ...
0
votes
2answers
324 views

Would it be possible to store Kerberos tickets on a YubiKey?

Kerberos supports different ways (ccache types) of storing tickets, such as: FILE MEMORY KEYRING I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
2
votes
0answers
256 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
0
votes
1answer
1k views

Security of KeePass and Yubikey OATH-HOTP

How secure is KeePass in addition with a Yubikey with OATH-HOTP? I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor. But ...
4
votes
2answers
453 views

Why aren't hardware SSH keys the default access for production systems?

In the Bitcoin world I see people using hardware key stores (and hardware signing devices) as the de-facto only secure way of storing and transmitting $M values. Wouldn't a hardware SSH keystore be ...
3
votes
1answer
1k views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
7
votes
1answer
3k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
4
votes
3answers
870 views

Why would it be a good idea for someone to get a YubiKey? [closed]

For what uses would it be smart to get a YubiKey?
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
2
votes
2answers
222 views

How does concatenating a user password and a YubiKey OTP work?

I use a Yubikey to log in to a VPN. When logging in, I supply a username, and then type a password, and without hitting return, touch the Yubikey. As far as I understand, and from experimenting, the ...
18
votes
1answer
2k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
2
votes
1answer
1k views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
1
vote
1answer
274 views

Yubikey for signing efi images, could not find token

I am trying to sign an efi image with a Yubikey 4 I configured Yubikey with the following: yubico-piv-tool -k $key -a import-key -s 9c < test-key.rsa yubico-piv-tool -k $key -a import-certificate ...
1
vote
1answer
960 views

Why do I get a warning when specifying the recipient for signing a document?

I just got a Yubikey 4 and I generate the key with gpg2 --card-edit and now I have this: $ gpg2 --list-key /home/lilas/.gnupg/pubring.kbx ------------------------------ pub rsa2048/EA3829E3 2016-11-...
1
vote
1answer
265 views

Is a yubikey with OpenPGP applet more secure then saving the private key in a encrypted USB stick?

If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11. But what is the point of using a Yubikey with ...
21
votes
4answers
3k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
2
votes
2answers
248 views

Does YubiKey with LastPass influence encryption?

I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the ...
4
votes
2answers
2k views

Why do I see “Secret key is available.” in gpg when it is not?

My master key is offline and I have subkeys on a Yubikey. As expected, I see sec# when listing keys when using the online system: gpg -K sec# 4096R/2FFA7695 2016-02-01 [expires: 2020-01-31] uid ...
1
vote
1answer
736 views

Is YubiKey vulnerable to BadUSB exploits?

I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated ...
10
votes
4answers
5k views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
-3
votes
1answer
871 views

How secure is using a Yubikey to unlock a MacBook Pro with Filevault?

I just got a MacBook and am planning on using it with Filevault and a Firmware password. How secure would using a new Yubikey be while using it to login using the standard method if the computer gets ...
8
votes
1answer
3k views

Using ECC for PGP-Master Key in combination with Yubikey

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But ...
6
votes
1answer
721 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
8
votes
1answer
892 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
17
votes
1answer
2k views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
3
votes
1answer
2k views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
3
votes
1answer
545 views

Is it possible to have an RSA authentication subkey with a DSA master key?

My key setup is as follows: sec dsa3072/CA72E53A created: 2013-05-12 expires: never usage: SCA trust: ultimate validity: ultimate The following key was revoked on 2016-01-13 ...
6
votes
1answer
635 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
6
votes
1answer
830 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
9
votes
1answer
4k views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
15
votes
2answers
4k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
10
votes
1answer
6k views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
1
vote
0answers
209 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
4
votes
3answers
675 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
6
votes
1answer
981 views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
0
votes
1answer
151 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
0
votes
1answer
235 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
37
votes
2answers
5k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
9
votes
2answers
2k views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
5
votes
1answer
491 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
2
votes
1answer
795 views

FIDO U2F use over multiple devices for the same service

I've been looking at the FIDO alliance's U2F specification and there's something which I can't seem to find documented. If I was to use a Yubikey or something similar as part of the authentication ...
13
votes
1answer
974 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
3
votes
1answer
951 views

What does the “configuration protection” mode do on Yubikeys?

I can't seem to find any documentation on what these options do: Does this somehow offer more protection to your secret key? That is all I can think it would do.
6
votes
2answers
727 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...