Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

How secure is Google’s/Android’s Smart Lock functionality?

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
10
votes
3answers
878 views

Is it safe to publish public PGP authentication subkeys?

Suppose I have a PGP key set up as follows: I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys. Then I create three ...
0
votes
1answer
1k views

Security of KeePass and Yubikey OATH-HOTP

How secure is KeePass in addition with a Yubikey with OATH-HOTP? I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor. But ...
9
votes
1answer
415 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
1
vote
1answer
290 views

Yubikey for signing efi images, could not find token

I am trying to sign an efi image with a Yubikey 4 I configured Yubikey with the following: yubico-piv-tool -k $key -a import-key -s 9c < test-key.rsa yubico-piv-tool -k $key -a import-certificate ...
2
votes
1answer
991 views

Why do I get a warning when specifying the recipient for signing a document?

I just got a Yubikey 4 and I generate the key with gpg2 --card-edit and now I have this: $ gpg2 --list-key /home/lilas/.gnupg/pubring.kbx ------------------------------ pub rsa2048/EA3829E3 2016-11-...
1
vote
1answer
267 views

Is a yubikey with OpenPGP applet more secure then saving the private key in a encrypted USB stick?

If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11. But what is the point of using a Yubikey with ...
2
votes
2answers
253 views

Does YubiKey with LastPass influence encryption?

I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the ...
1
vote
1answer
753 views

Is YubiKey vulnerable to BadUSB exploits?

I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated ...
-3
votes
1answer
890 views

How secure is using a Yubikey to unlock a MacBook Pro with Filevault?

I just got a MacBook and am planning on using it with Filevault and a Firmware password. How secure would using a new Yubikey be while using it to login using the standard method if the computer gets ...
6
votes
1answer
741 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
4
votes
1answer
870 views

Yubikey with gpg2

I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
8
votes
1answer
896 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
5
votes
1answer
2k views

uploading pkcs12 to yubikey piv slot

i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
3
votes
1answer
2k views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
2
votes
1answer
1k views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
4
votes
2answers
2k views

Why do I see “Secret key is available.” in gpg when it is not?

My master key is offline and I have subkeys on a Yubikey. As expected, I see sec# when listing keys when using the online system: gpg -K sec# 4096R/2FFA7695 2016-02-01 [expires: 2020-01-31] uid ...
2
votes
1answer
1k views

Yubikey with S/MIME certificate

I would like to do the following. Can anyone tell me if this is possible? Store the private key for an S/MIME certificate from Digicert on a Yubikey. Backup the private key to another location. Use ...
3
votes
1answer
552 views

Is it possible to have an RSA authentication subkey with a DSA master key?

My key setup is as follows: sec dsa3072/CA72E53A created: 2013-05-12 expires: never usage: SCA trust: ultimate validity: ultimate The following key was revoked on 2016-01-13 ...
11
votes
2answers
8k views

Yubikey with KeePass using challenge-response vs OATH-HOTP

i got my YubiKey 4 today and first tried it to use KeePass with OATH-HOTP (OtpKeyProv plugin). My Configuration was 3 OTPs with look-ahead count = 0. It was not working that good because sometimes the ...
9
votes
1answer
4k views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
6
votes
1answer
838 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
6
votes
1answer
642 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
6
votes
1answer
2k views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
10
votes
1answer
6k views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
1
vote
0answers
209 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
17
votes
1answer
2k views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
6
votes
1answer
1k views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
0
votes
1answer
153 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
0
votes
1answer
237 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
8
votes
1answer
3k views

Using ECC for PGP-Master Key in combination with Yubikey

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But ...
37
votes
2answers
5k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
10
votes
4answers
5k views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
5
votes
1answer
506 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
2
votes
1answer
804 views

FIDO U2F use over multiple devices for the same service

I've been looking at the FIDO alliance's U2F specification and there's something which I can't seem to find documented. If I was to use a Yubikey or something similar as part of the authentication ...
4
votes
3answers
688 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
3
votes
1answer
960 views

What does the “configuration protection” mode do on Yubikeys?

I can't seem to find any documentation on what these options do: Does this somehow offer more protection to your secret key? That is all I can think it would do.
6
votes
2answers
731 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
0
votes
1answer
1k views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
11
votes
2answers
3k views

What is the purpose of yubikey

I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to ...
13
votes
1answer
981 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
7
votes
1answer
3k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
18
votes
1answer
2k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
9
votes
2answers
2k views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
2
votes
2answers
870 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
9
votes
3answers
5k views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
15
votes
2answers
4k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
9
votes
2answers
8k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted (...
21
votes
4answers
3k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...