Hot answers tagged

52

Short answer Where would this data live on the device if not on something like flash storage? It probably is flash, but it's put in a chip that's hard to take apart and examine without destroying the data you're trying to read. It's not impossible to do, but it's really quite difficult and expensive. It's not like a hard drive or flash drive where you can ...


48

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private ...


45

As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Yubikey generating it. A website ...


24

Hardware crypto modules like this are regulated by a set of standards called FIPS 140-2 which specify the ridiculous lengths that the devices must go to in order to protect the private keys inside them. There are four levels of FIPS 140-2, briefly summarized as: Level 1: It does basic crypto-y things. Level 2: "Tamper-evident"; it's impossible to extract ...


19

The YubiKey comes in different variants, for example the YubiKey 4 and the YubiKey U2F. All YubiKeys are hardware tokens and are connected to a USB port. Most feature an inductive button and one model also has NFC (the YubiKey Neo). The variants differ regarding form factor and the number of supported features. The YubiKey 4 provides several functions: OTP ...


16

After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of making the key work on a different computer (with the smartcard), but these days, as there is sufficient information stored about the key, all you need is to use --...


12

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


12

You need to run: gpg --card-status and gpg will do it for you: /tmp$ mkdir gpgtmp /tmp$ chmod go-rwx gpgtmp /tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt gpg: opvragen sleutel F8713BDF van hkp sleutelserver pgp.mit....


11

GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private key cryptographic operations. The special protection is based on the fact that the keys never can leave the YubiKey, so an attacker could at most make use of ...


10

YubiKey has a office in California. LastPass has one in Washington. That means that both companies are legally required to give the NSA your data should the NSA give them a National Security Letter. I see no real reason to use a closed source system like LastPass where you have to trust an US company over an open source solution like KeePass.


10

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


10

You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply? Cryptographic Smart Cards The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations: create ...


10

I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. The secret key subpacket looks like this when displayed through gpg --list-packets: :secret sub key packet: version 4, algo 1, created 1358985314, ...


10

Well designed password managers do not rely on authentication for their security; instead they rely on encryption. So unlocking a password manager data base doesn't even involve single factor authentication, much less multi-factor authentication. How a password manager can use a Yubikey What this means is that the kind of thing that is normally used to ...


9

found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup card, not the worst case to run an "init" to make it work. https://forum.yubico.com/viewtopic38a1.html?f=35&t=2400 Running gpg-connect-agent "scd ...


9

Size and performance don't matter, as a hardware security module (HSM) is defined by its functions to perform cryptographic operations and protection. From Peter Smirnoff on Cryptomathic: Understanding Hardware Security Modules (HSMs): The hardware security module (HSM) is a special “trusted” network computer performing a variety of cryptographic operations:...


8

When you start with a fresh installation, you have two options: Plug the smart card (Yubikey) and run gpg --card-edit fetch quit Then, running gpg with the --card-status option to create the stubs for the secret keys: gpg --card-status Import your public key from a key server (the fetch command above does the same automatically), then gpg --card-status ...


8

No, you are safe Even if you entered it inside a malicious computer, your key could not be compromised. It uses the same security as a credit card; meaning a smart card. This smart card contains a private key that is not disclosed unless you physically open the smart card. This is the reason why credit cards with a smart card are so much better than credit ...


8

No, the Yubikey 4 is not Open Source: The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to remember that open source code is no guarantee that bugs/vulnerabilities will be detected as the bug you've linked to demonstrates quite well. The bug was inherited ...


7

If it is plugged into an infected computer, wouldn't the secret key be compromised? The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters ...


7

Per the Yubikey FAQ they state the following: ..."All YubiKey NEO devices manufactured as of February 10, 2015 supported the current FIDO U2F specification for NFC. To verify you have a YubiKey NEO that supports NFC, check to see your YubiKey is running firmware version 3.4.0 or later."... Likewise, the YubiKey 4 (v4) and Neo (v3) are also listed as ...


7

First of all, be aware that the Yubikey does not support ECC keys (but I don't read from your question that you assumed that). If you use an ECC primary key, others using older implementations of GnuPG not supporting ECC keys (thus, everything before GnuPG 2.1) will not be able to verify your primary key nor signatures issued by you, as it does not ...


7

Solution Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d. You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip. If all your private keys are on external cards like the Yubikey, you can delete them all using: rm -r ~/.gnupg/private-keys-v1.d See here for more information about the private-keys-v1.d ...


6

From the YubiCo docs: "To protect against unauthorized update of a specific configuration, a protection access code can be added. Then, in order to update or remove this configuration, the corresponding access code must be used, otherwise the request is rejected."


6

In my opinion U2F lacks one thing at the moment: The privacy of your secret key. Each device comes with it's own secret key. A site specific key is derived from this secret key to do the challenge response when logging in to a site. This is ment to keep you anonymous and easily register and authenticate at a site. But! Each U2F device that is sold nowadays ...


6

If you put the subkeys on the YubiKey, you still should keep the primary private key around somewhere -- it is the only entity that can be used to revoke the keys, create new subkeys, modify user IDs, certify other's keys, ... How do I check that all 3 subkeys and no master-key is on the Yubikey 4? How do I check that no sensitive key-material is on ...


6

Usability The Yubico AES mode does only work with a yubikey. The device returns a long data structure, that needs to be decrypted. HOTP returns a 6 or 8 digit code. The algorithm uses a truncation to form the digit code. The digit code is created so that a user is able to read the code and type the code into a keyboard. Thus: With Yubico AES mode you need ...


6

It's hard to compare the two, but I'd say they are roughly similar when it comes to risk profiles. An app running on your phone is generally more isolated from other apps compared to applications using standard desktop environments. A rogue smartphone app that does not have root-level access would not be able to access other application's data nor see what ...


5

The source code of password Safe is open source so you're free to do what I did: check. A HMAC takes two inputs: the key and the data. What PS does wirth the ubikey is take your input as data and send it to the UbiKey. The key is in the UbiKey itself ans stays there. So, the sequence of event is the following: You enter your passphrase. The software sends ...


5

using Yubikey (NEO)'s to store the private SSH keys of my users This use-case is described on yubico website here: https://developers.yubico.com/yubico-piv-tool/SSH_with_PIV_and_PKCS11.html What I can't seem to find anything about is a way to also sign the key and load that into gpg-agent using OpenSSH's method for signing user keys. The step 2 from the ...


Only top voted, non community-wiki answers of a minimum length are eligible