Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
2
votes
2answers
532 views

Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?

I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
9
votes
1answer
417 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
0
votes
0answers
34 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
6
votes
1answer
2k views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
1
vote
1answer
96 views

Creating pointers to keys on SmartCard

I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task. I am trying to sign a file with a private key stored on a YubiKey device. Here is my session: $ ...
0
votes
2answers
127 views

Hardware security key with locked down usb slots

I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to ...
0
votes
1answer
85 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
54
votes
5answers
25k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
2
votes
0answers
44 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
1
vote
1answer
43 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
0
votes
2answers
510 views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
0
votes
0answers
36 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
1
vote
0answers
84 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
3
votes
1answer
503 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
0
votes
0answers
86 views

Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?

I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
2
votes
2answers
106 views

GPG: Change expected card number

I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. ...
2
votes
1answer
112 views

gpg ignores passphrase on my key stored on yubikey 5 nfc

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A). While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
1
vote
2answers
664 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
1
vote
1answer
309 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
3
votes
3answers
2k views

Is it reasonable to use KeePassXC with YubiKey?

At the moment, I am using KeePassXC with a relatively strong master password. To further improve security, I thought about buying a YubiKey to have 2-Factor-Authentication. KeePassXC supports the so ...
2
votes
1answer
68 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
2
votes
0answers
56 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
1
vote
0answers
73 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
2
votes
1answer
208 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
5
votes
1answer
2k views

uploading pkcs12 to yubikey piv slot

i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
3
votes
1answer
2k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
1
vote
0answers
623 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
11
votes
4answers
4k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
6
votes
6answers
384 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
1
vote
1answer
265 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
0
votes
0answers
28 views

Authentication implications for a mapped PIV certificate

I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on. Some of the devices I've looked ...
4
votes
1answer
870 views

Yubikey with gpg2

I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
3
votes
0answers
177 views

yubikey creating different ssh public key having same GPG

I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
0
votes
1answer
116 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
11
votes
2answers
8k views

Yubikey with KeePass using challenge-response vs OATH-HOTP

i got my YubiKey 4 today and first tried it to use KeePass with OATH-HOTP (OtpKeyProv plugin). My Configuration was 3 OTPs with look-ahead count = 0. It was not working that good because sometimes the ...
0
votes
0answers
529 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
2
votes
4answers
432 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
3
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
5
votes
1answer
428 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
0
votes
1answer
90 views

Deterministic password generation using Yubikey

I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey ...
0
votes
1answer
189 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
5
votes
1answer
279 views

Yubikey Desktop Authenticator

Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator? Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
0
votes
1answer
131 views

How to use master password for GPG encryption after setting up Yubikey? [closed]

I just setup my Yubikey 4 on Windows. How can I use master password for signing/encrypting when I don't have my key? If the yubikey is not inserted I get an error "Please insert the card with serial ...
13
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
3
votes
1answer
2k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
1
vote
0answers
272 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
2
votes
1answer
2k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
30
votes
4answers
7k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
10
votes
3answers
879 views

Is it safe to publish public PGP authentication subkeys?

Suppose I have a PGP key set up as follows: I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys. Then I create three ...
3
votes
2answers
516 views

Encryption using multiple Yubikeys, any of which can unlock

I was hoping to use my Yubikey for file encryption, but also wanted to have a backup Yubikey work to unlock the file. From a conceptual point of view, I know it is possible since, even as is, I ...