53
votes
Accepted
Is there a Yubikey equivalent to "stealing the hard drive"?
Short answer
Where would this data live on the device if not on something like flash storage?
It probably is flash, but it's put in a chip that's hard to take apart and examine without destroying ...
- 66.5k
43
votes
Is a USB security key trackable among websites?
The owner of the two sites may be able to track you from one site to the other using methods such as browser fingerprinting or other ways of tracking users as they surf from site to site; but they won'...
- 22.7k
34
votes
Is it reasonable to use KeePassXC with YubiKey?
KeePassXC developer here, I got directed to this thread and want to add some remarks.
The answer by Jeffrey from 1Password is technically accurate. The YubiKey is used in a mode which is slightly ...
- 941
21
votes
Accepted
gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey
Solution
Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.
You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.
If all your private keys are on ...
- 583
19
votes
Accepted
What is a YubiKey and how does it work?
The YubiKey comes in different variants, for example the YubiKey 4 and the YubiKey U2F. All YubiKeys are hardware tokens and are connected to a USB port. Most feature an inductive button and one model ...
- 550
19
votes
Accepted
export-secret-key after Yubikey is plugged in
After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of ...
- 781
15
votes
Is it reasonable to use KeePassXC with YubiKey?
Well designed password managers do not rely on authentication for their security; instead they rely on encryption. So unlocking a password manager data base doesn't even involve single factor ...
- 6,565
14
votes
Create backup Yubikey with identical PGP keys
found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup ...
- 249
11
votes
Accepted
GPG encryption subkey on multiple smart cards issue
I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. ...
- 24.4k
11
votes
Accepted
How to use YubiKey through GnuPG on remote server?
GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private ...
- 24.4k
10
votes
Accepted
GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?
If you put the subkeys on the YubiKey, you still should keep the primary private key around somewhere -- it is the only entity that can be used to revoke the keys, create new subkeys, modify user IDs, ...
- 24.4k
10
votes
Accepted
Where are FIDO U2F Keys Stored?
The keys can be either stored on the device, or encrypted and returned in the key handle. Both are allowed (and mentioned) by the spec.
From the implementation considerations:
U2F tokens might not ...
- 4,261
10
votes
A stolen security key enables full access; why are such keys considered more secure than authenticator apps?
There are of course many use scenarios and variables. In general, assuming everything else is implemented well, it boils down to What You Have.
A properly implemented Yubikey cannot be cloned. It can ...
- 8,118
9
votes
Accepted
Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?
No, you are safe
Even if you entered it inside a malicious computer, your key could not be compromised. It uses the same security as a credit card; meaning a smart card. This smart card contains a ...
- 6,981
9
votes
Accepted
GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?
You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply?
Cryptographic ...
- 24.4k
9
votes
Why is YubiHSM an HSM?
Size and performance don't matter, as a hardware security module (HSM) is defined by its functions to perform cryptographic operations and protection. From Peter Smirnoff on Cryptomathic: ...
- 18.7k
8
votes
Accepted
Is the OpenPGP implementation of the YubiKey 4 Open Source?
No, the Yubikey 4 is not Open Source:
The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to ...
- 1,680
8
votes
Accepted
Relative merits of Yubico OTP vs. OATH-HOTP?
Usability
The Yubico AES mode does only work with a yubikey. The device returns a long data structure, that needs to be decrypted.
HOTP returns a 6 or 8 digit code. The algorithm uses a truncation ...
- 2,043
8
votes
Accepted
Can I generate and store keys on my Yubico?
U2F
The keys used in U2F are generated by the device it self, you can't do it yourself. Yubico's Developer webpage explain it very clearly. For short, take a look the graph below.
Device Secret is ...
- 436
8
votes
A stolen security key enables full access; why are such keys considered more secure than authenticator apps?
Using a Yubikey (or any other FIDO2/WebAuthN token) as a single factor is an option, but you certainly don't have to use it that way. There's literally nothing you can log into using only my Yubikey; ...
- 46.3k
7
votes
Accepted
FIDO, U2F Compatibility
Per the Yubikey FAQ they state the following:
..."All YubiKey NEO devices manufactured as of February 10, 2015 supported the current FIDO U2F specification for NFC. To verify you have a YubiKey NEO ...
- 14.2k
7
votes
Is it safe to publish public PGP authentication subkeys?
By providing more keys to potential attackers than necessary, you are violating the principle of least privilege (why should anyone else have the privilege to view your public key?). If they don't ...
- 330
7
votes
Accepted
Create backup Yubikey with identical PGP keys
After a lot trial and error, I finally found a way to achieve this. Here is an answer to my own question in case it helps someone :
The trick was to not try to export the same subkeys to the two ...
- 421
7
votes
Create backup Yubikey with identical PGP keys
Instead of backing up an entire directory you can export (create a backup copy of) the key using e.g.
gpg -a -o seckey.asc --export-secret-key ABCD1234
and import it again (after moving to first ...
- 535
7
votes
Accepted
How do I back up YubiKey-backed TOTP authentication?
When setting up TOTP with a site, they give you a shared secret.
Yubico Authenticator uses your Yubikey to store that info. As long as your key is present, all instances of Yubico Authenticator ...
- 803
7
votes
Accepted
Can a provider allowing 2FA with a Yubikey identify me if I use the same key for different accounts?
With Yubikey's alphanumeric one-time passwords, yes:
Each Yubikey had a unique public identifier. The authentication server must know this ID in order to select the correct AES key for the OTP. The ...
- 3,942
6
votes
Accepted
Why do I see "Secret key is available." in gpg when it is not?
Tested with several recent versions of GnuPG. Am I misunderstanding this message? Is this just another example of gpg's horrible UI or a bug?
GnuPG isn't completely wrong here, a secret key stub is ...
- 24.4k
6
votes
Accepted
How to manage employee OpenPGP keys?
I am trying to create a secured policy for storing and maintaining keys between users of my company.
The following answer is based on those requirements I assume based on your post (I'll call your ...
- 24.4k
6
votes
Yubikey Desktop Authenticator
It's hard to compare the two, but I'd say they are roughly similar when it comes to risk profiles.
An app running on your phone is generally more isolated from other apps compared to applications ...
- 6,428
6
votes
Why can GPG sign messages but not keys?
Signing and key signing is done by different subkeys. You have:
$ gpg --list-secret-keys
sec# rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
Key fingerprint = DEAD BEEF DEAD BEEF DEAD BEEF DEAD ...
- 18.8k
Only top scored, non community-wiki answers of a minimum length are eligible