Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
3
votes
2answers
528 views

Encryption using multiple Yubikeys, any of which can unlock

I was hoping to use my Yubikey for file encryption, but also wanted to have a backup Yubikey work to unlock the file. From a conceptual point of view, I know it is possible since, even as is, I ...
3
votes
1answer
565 views

Is it possible to have an RSA authentication subkey with a DSA master key?

My key setup is as follows: sec dsa3072/CA72E53A created: 2013-05-12 expires: never usage: SCA trust: ultimate validity: ultimate The following key was revoked on 2016-01-13 ...
3
votes
1answer
509 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
3
votes
0answers
183 views

yubikey creating different ssh public key having same GPG

I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
3
votes
0answers
818 views

How do security properties of Trezor's FIDO U2F differ from Yubikey?

Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey: The keys are always generated on the device and never rely on the manufacturer ...
2
votes
4answers
453 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
2
votes
1answer
131 views

gpg ignores passphrase on my key stored on yubikey 5 nfc

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A). While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
2
votes
1answer
70 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
2
votes
1answer
1k views

Why do I get a warning when specifying the recipient for signing a document?

I just got a Yubikey 4 and I generate the key with gpg2 --card-edit and now I have this: $ gpg2 --list-key /home/lilas/.gnupg/pubring.kbx ------------------------------ pub rsa2048/EA3829E3 2016-11-...
2
votes
2answers
258 views

Does YubiKey with LastPass influence encryption?

I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the ...
2
votes
2answers
233 views

How does concatenating a user password and a YubiKey OTP work?

I use a Yubikey to log in to a VPN. When logging in, I supply a username, and then type a password, and without hitting return, touch the Yubikey. As far as I understand, and from experimenting, the ...
2
votes
1answer
1k views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
2
votes
2answers
871 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
2
votes
1answer
257 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
2answers
569 views

Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?

I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
2
votes
1answer
1k views

Yubikey with S/MIME certificate

I would like to do the following. Can anyone tell me if this is possible? Store the private key for an S/MIME certificate from Digicert on a Yubikey. Backup the private key to another location. Use ...
2
votes
1answer
820 views

FIDO U2F use over multiple devices for the same service

I've been looking at the FIDO alliance's U2F specification and there's something which I can't seem to find documented. If I was to use a Yubikey or something similar as part of the authentication ...
2
votes
0answers
49 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
2
votes
2answers
129 views

GPG: Change expected card number

I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. ...
2
votes
0answers
68 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
2
votes
1answer
3k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
2
votes
0answers
263 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
1
vote
1answer
772 views

Is YubiKey vulnerable to BadUSB exploits?

I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated ...
1
vote
1answer
1k views

Can I generate and store keys on my Yubico?

Its a simple question but there's no answer in the Yubico's website When I recive a Yubico (from the Yubico 4 series), I know I can sign code, for example. But how is the key inside it generated? Is ...
1
vote
1answer
52 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
1
vote
2answers
858 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
1
vote
1answer
269 views

Is a yubikey with OpenPGP applet more secure then saving the private key in a encrypted USB stick?

If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11. But what is the point of using a Yubikey with ...
1
vote
2answers
753 views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
1
vote
0answers
72 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
1
vote
1answer
101 views

Creating pointers to keys on SmartCard

I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task. I am trying to sign a file with a private key stored on a YubiKey device. Here is my session: $ ...
1
vote
0answers
93 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
1
vote
1answer
372 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
1
vote
0answers
76 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
1
vote
0answers
680 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
1answer
300 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
1
vote
0answers
287 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
1
vote
0answers
84 views

Are all the FIDO U2F tools from Yubico cross-compatible

So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
1
vote
1answer
299 views

Yubikey for signing efi images, could not find token

I am trying to sign an efi image with a Yubikey 4 I configured Yubikey with the following: yubico-piv-tool -k $key -a import-key -s 9c < test-key.rsa yubico-piv-tool -k $key -a import-certificate ...
1
vote
0answers
211 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
0
votes
1answer
97 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
0
votes
1answer
122 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
0
votes
1answer
138 views

How to use master password for GPG encryption after setting up Yubikey? [closed]

I just setup my Yubikey 4 on Windows. How can I use master password for signing/encrypting when I don't have my key? If the yubikey is not inserted I get an error "Please insert the card with serial ...
0
votes
1answer
238 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
0
votes
1answer
1k views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
0
votes
1answer
96 views

Deterministic password generation using Yubikey

I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey ...
0
votes
1answer
204 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
0
votes
2answers
360 views

Would it be possible to store Kerberos tickets on a YubiKey?

Kerberos supports different ways (ccache types) of storing tickets, such as: FILE MEMORY KEYRING I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
0
votes
1answer
1k views

Security of KeePass and Yubikey OATH-HOTP

How secure is KeePass in addition with a Yubikey with OATH-HOTP? I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor. But ...
0
votes
1answer
160 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...