Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
54
votes
5answers
25k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
37
votes
2answers
5k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
30
votes
4answers
7k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
21
votes
4answers
3k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
18
votes
1answer
2k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
17
votes
1answer
2k views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
15
votes
2answers
4k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
13
votes
3answers
2k views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) SMS/Voice ...
13
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
13
votes
1answer
974 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
11
votes
2answers
3k views

What is the purpose of yubikey

I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to ...
11
votes
4answers
3k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
11
votes
2answers
7k views

Yubikey with KeePass using challenge-response vs OATH-HOTP

i got my YubiKey 4 today and first tried it to use KeePass with OATH-HOTP (OtpKeyProv plugin). My Configuration was 3 OTPs with look-ahead count = 0. It was not working that good because sometimes the ...
10
votes
1answer
6k views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
10
votes
3answers
857 views

Is it safe to publish public PGP authentication subkeys?

Suppose I have a PGP key set up as follows: I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys. Then I create three ...
10
votes
4answers
5k views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
9
votes
3answers
5k views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
9
votes
2answers
8k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted (...
9
votes
2answers
2k views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
9
votes
1answer
4k views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
9
votes
1answer
399 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
8
votes
1answer
892 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
8
votes
1answer
3k views

Using ECC for PGP-Master Key in combination with Yubikey

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But ...
7
votes
1answer
3k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
6
votes
6answers
384 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
6
votes
1answer
635 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
6
votes
1answer
981 views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
6
votes
2answers
727 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
6
votes
1answer
721 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
6
votes
1answer
830 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
5
votes
1answer
274 views

Yubikey Desktop Authenticator

Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator? Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
5
votes
1answer
491 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
5
votes
1answer
2k views

uploading pkcs12 to yubikey piv slot

i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
5
votes
1answer
405 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
5
votes
1answer
1k views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
4
votes
3answers
870 views

Why would it be a good idea for someone to get a YubiKey? [closed]

For what uses would it be smart to get a YubiKey?
4
votes
2answers
453 views

Why aren't hardware SSH keys the default access for production systems?

In the Bitcoin world I see people using hardware key stores (and hardware signing devices) as the de-facto only secure way of storing and transmitting $M values. Wouldn't a hardware SSH keystore be ...
4
votes
2answers
2k views

Why do I see “Secret key is available.” in gpg when it is not?

My master key is offline and I have subkeys on a Yubikey. As expected, I see sec# when listing keys when using the online system: gpg -K sec# 4096R/2FFA7695 2016-02-01 [expires: 2020-01-31] uid ...
4
votes
3answers
674 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
4
votes
1answer
1k views

How secure is Google’s/Android’s Smart Lock functionality?

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
4
votes
1answer
137 views

Finding out the password or bypass Linux password for home encryption?

I forgot the password of one of my account on Ubuntu 16.04. The user account directory is encrypted. I have configured the Yubikey SSH key based login so I am able to login, into that account. But ...
4
votes
1answer
859 views

Yubikey with gpg2

I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
4
votes
2answers
308 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
3
votes
3answers
2k views

Is it reasonable to use KeePassXC with YubiKey?

At the moment, I am using KeePassXC with a relatively strong master password. To further improve security, I thought about buying a YubiKey to have 2-Factor-Authentication. KeePassXC supports the so ...
3
votes
1answer
1k views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
3
votes
1answer
950 views

What does the “configuration protection” mode do on Yubikeys?

I can't seem to find any documentation on what these options do: Does this somehow offer more protection to your secret key? That is all I can think it would do.
3
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
3
votes
1answer
2k views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
3
votes
1answer
2k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
3
votes
1answer
2k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...