Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
-2
votes
1answer
108 views

Why is YubiHSM an HSM?

What makes the YubiHSM an HSM? Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
1
vote
1answer
67 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
0
votes
4answers
159 views

AWS - YubiKey lost… now what?

I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, ...
0
votes
1answer
49 views

Help using my yubikey with facebook

I just purchased a Yubikey 5 NFC. I want to use it to make my accounts a little more secure. I have added 2fa to my facebook account and I have added that key to my yubikey. So far, so good. Now I ...
0
votes
0answers
35 views

FIDO2 Windows vs Linux

I am using a Yubikey 5C as a MFA & smartcard for various application. On my Windows 10 desktop I have set up a FIDO2 PIN - so if I would like to use it within Firefox for example, I have to enter ...
1
vote
0answers
59 views

Security risks of selling a used YubiKey / Factory resetting a YubiKey

I am a proud owner of a YubiKey 5 NFC and have been using it for quite some time now. I want to replace it with another YubiKey 5 NFC running a slightly newer firmware. I have utilized almost all ...
4
votes
2answers
134 views

Yubikey PGP migration

I am currently using a Yubikey 4 with my PGP subkeys on it. My mainkey is stored within Kleopatra. As I am planning to move over to a new Yubikey 5 I have asked myself if it is possible to still be ...
0
votes
1answer
153 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
1
vote
2answers
124 views

Is there a way to “lock” a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
1
vote
2answers
346 views

Do PKCS #11 keyfiles on a yubikey actually improve security for Veracrypt?

I am trying to understand the benefits of a PKCS #11 keyfile stored on a smartcard such as a YubiKey with regards to Veracrypt volumes. Am I correct that the file will be taken off of the hardware ...
4
votes
1answer
169 views

How does the attestation mechanism of U2F guarantee the provenance of the key material?

I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece. The security claim appears to be that the authoritatively-signed attestation ...
0
votes
0answers
36 views

Looking for ability to identify U2F device

I know that in terms of security it is not good idea (as explained here: https://github.com/Yubico/libu2f-host/issues/45#issuecomment-337013420). But we can live with that. Is there any extension of ...
0
votes
1answer
573 views

gpg2: How to get rid of “Please insert card with serial number”, getting the same key from a different card / Yubikey

I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers. After switching the keys ...
0
votes
0answers
76 views

Could a Hardware Token Defeat a Keylogger?

I would like to improve my understanding of keyloggers by asking what is feasible with current technology. That is, I mean to be asking a conceptual question that doesn't verge into sci-fi. My ...
0
votes
1answer
153 views

Is there a way to generate a Yubikey OTP without touch?

I'm trying to automate an authentication canary in a workflow that includes a mandatory Yubikey OTP (the 44-character unique password). Is there a way to configure a single Yubikey in such a way that ...
3
votes
1answer
118 views

Can a provider allowing 2FA with a Yubikey identify me if I use the same key for different accounts?

I was wondering if someone providing a service can identify me (other than by IP, browser fingerprinting etc.) purely based on the code generated by the Yubikey when I touch it, if I use the same ...
1
vote
0answers
43 views

OpenPGP and 3 Yubikeys, Best Practice for Encryption Subkey

New to OpenPGP. I have 3 Yubikeys, one for my laptop, one for my desktop, and one which I plan to keep in cold storage as a backup. My plan was to create a S/E/A subkey for each Yubikey, attached to ...
0
votes
0answers
69 views

Is Yubikey HSM2 FIPS Compliant?

I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series. (https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search) ...
3
votes
0answers
53 views

What exactly is the Management Key on a yubikey?

The yubico documentation mentions that a Management Key can be set manually, or it can be inferred in the SoC when setting a PIN for the first time. What exactly is that management key and how does ...
2
votes
4answers
1k views

Can you set up 2FA with a USB drive?

I want to set up two factor authentication for some of my online accounts. I don't want to install an app, and I don't like using my phone as the physical medium anyway, because it's more likely to ...
0
votes
0answers
123 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
2
votes
0answers
526 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
0
votes
0answers
156 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
1
vote
1answer
182 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
1
vote
2answers
160 views

Hardware security key with locked down usb slots

I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to ...
2
votes
0answers
55 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
1
vote
1answer
77 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
1
vote
1answer
155 views

Creating pointers to keys on SmartCard

I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task. I am trying to sign a file with a private key stored on a YubiKey device. Here is my session: $ ...
4
votes
0answers
145 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
4
votes
2answers
3k views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
2
votes
2answers
228 views

GPG: Change expected card number

I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. ...
2
votes
1answer
207 views

gpg ignores passphrase on my key stored on yubikey 5 nfc

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A). While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
3
votes
2answers
2k views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
1
vote
1answer
701 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
8
votes
4answers
7k views

Is it reasonable to use KeePassXC with YubiKey?

At the moment, I am using KeePassXC with a relatively strong master password. To further improve security, I thought about buying a YubiKey to have 2-Factor-Authentication. KeePassXC supports the so ...
2
votes
1answer
83 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
3
votes
0answers
77 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
1
vote
0answers
80 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
2
votes
1answer
523 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
1
vote
0answers
903 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
1answer
474 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
4
votes
0answers
219 views

yubikey creating different ssh public key having same GPG

I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
0
votes
1answer
138 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
2
votes
2answers
771 views

Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?

I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
0
votes
0answers
1k views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
2
votes
4answers
541 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
0
votes
1answer
115 views

Deterministic password generation using Yubikey

I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey ...
8
votes
1answer
622 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
0
votes
1answer
275 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
16
votes
4answers
6k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...