Hot answers tagged

46

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private ...


42

As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Yubikey generating it. A website ...


24

Hardware crypto modules like this are regulated by a set of standards called FIPS 140-2 which specify the ridiculous lengths that the devices must go to in order to protect the private keys inside them. There are four levels of FIPS 140-2, briefly summarized as: Level 1: It does basic crypto-y things. Level 2: "Tamper-evident"; it's impossible to extract ...


19

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


18

There are some explanations on what YubiKey does here. Basically, the password which the YubiKey "types" (from the point of view of the computer, it is a keyboard) can be either a static password, or a one-time password. If it is a static password, then you just revealed it, and it is time to be very sorry (and promptly change that password). The one-time ...


18

The YubiKey comes in different variants, for example the YubiKey 4 and the YubiKey U2F. All YubiKeys are hardware tokens and are connected to a USB port. Most feature an inductive button and one model also has NFC (the YubiKey Neo). The variants differ regarding form factor and the number of supported features. The YubiKey 4 provides several functions: OTP ...


16

After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of making the key work on a different computer (with the smartcard), but these days, as there is sufficient information stored about the key, all you need is to use --...


12

You need to run: gpg --card-status and gpg will do it for you: /tmp$ mkdir gpgtmp /tmp$ chmod go-rwx gpgtmp /tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt gpg: opvragen sleutel F8713BDF van hkp sleutelserver pgp.mit....


12

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


10

Have a look over here http://www.linuxjournal.com/magazine/yubikey-one-time-password-authentication The following outtake is written by Dirk Merkel, author of the previously linked article: Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard. This password ...


10

You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply? Cryptographic Smart Cards The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations: create ...


10

I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. The secret key subpacket looks like this when displayed through gpg --list-packets: :secret sub key packet: version 4, algo 1, created 1358985314, ...


10

Well designed password managers do not rely on authentication for their security; instead they rely on encryption. So unlocking a password manager data base doesn't even involve single factor authentication, much less multi-factor authentication. How a password manager can use a Yubikey What this means is that the kind of thing that is normally used to ...


9

YubiKey has a office in California. LastPass has one in Washington. That means that both companies are legally required to give the NSA your data should the NSA give them a National Security Letter. I see no real reason to use a closed source system like LastPass where you have to trust an US company over an open source solution like KeePass.


9

Assuming the user has a multifactor device and forgets their password, how should that affect the "forgot password" workflow? If the user is initiating password reset from an unrecognized device/browser then a second factor of authentication should be required to perform a password reset. Best practice is to require the second factor consistently across all ...


9

GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private key cryptographic operations. The special protection is based on the fact that the keys never can leave the YubiKey, so an attacker could at most make use of ...


8

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


8

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is Key-...


8

No, you are safe Even if you entered it inside a malicious computer, your key could not be compromised. It uses the same security as a credit card; meaning a smart card. This smart card contains a private key that is not disclosed unless you physically open the smart card. This is the reason why credit cards with a smart card are so much better than credit ...


8

found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup card, not the worst case to run an "init" to make it work. https://forum.yubico.com/viewtopic38a1.html?f=35&t=2400 Running gpg-connect-agent "scd ...


7

Both the validation server and YubiKey OTP use a uniquely-structured AES-encrypted key for validation. The security information about the Yubico Validation server and YubiKey OTP is available here. You can also discuss the validation server with other users on the Yubico forums.


7

If it is plugged into an infected computer, wouldn't the secret key be compromised? The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters ...


7

Per the Yubikey FAQ they state the following: ..."All YubiKey NEO devices manufactured as of February 10, 2015 supported the current FIDO U2F specification for NFC. To verify you have a YubiKey NEO that supports NFC, check to see your YubiKey is running firmware version 3.4.0 or later."... Likewise, the YubiKey 4 (v4) and Neo (v3) are also listed as ...


7

First of all, be aware that the Yubikey does not support ECC keys (but I don't read from your question that you assumed that). If you use an ECC primary key, others using older implementations of GnuPG not supporting ECC keys (thus, everything before GnuPG 2.1) will not be able to verify your primary key nor signatures issued by you, as it does not ...


7

No, the Yubikey 4 is not Open Source: The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to remember that open source code is no guarantee that bugs/vulnerabilities will be detected as the bug you've linked to demonstrates quite well. The bug was inherited ...


7

Size and performance don't matter, as a hardware security module (HSM) is defined by its functions to perform cryptographic operations and protection. From Peter Smirnoff on Cryptomathic: Understanding Hardware Security Modules (HSMs): The hardware security module (HSM) is a special “trusted” network computer performing a variety of cryptographic operations:...


6

I have several multifactor authnetication devices linked to my paypal account. I also have two different multi-factor authentication devices securing my stackexchange logon. It is definitely possible to do so. THere are multiple requirements to do so. One is simple convenience (I authenticate with the device nearest to me at the time). A more formal ...


6

When you start with a fresh installation, you have two options: Plug the smart card (Yubikey) and run gpg --card-edit fetch quit Then, running gpg with the --card-status option to create the stubs for the secret keys: gpg --card-status Import your public key from a key server (the fetch command above does the same automatically), then gpg --card-status ...


6

From the YubiCo docs: "To protect against unauthorized update of a specific configuration, a protection access code can be added. Then, in order to update or remove this configuration, the corresponding access code must be used, otherwise the request is rejected."


6

In my opinion U2F lacks one thing at the moment: The privacy of your secret key. Each device comes with it's own secret key. A site specific key is derived from this secret key to do the challenge response when logging in to a site. This is ment to keep you anonymous and easily register and authenticate at a site. But! Each U2F device that is sold nowadays ...


Only top voted, non community-wiki answers of a minimum length are eligible