Collaborate Disseminate
I wonder if the NSA can force Yubico (or their secure element chip supplier), a US company located in Palo Alto, California, to hand over the private keys stored in the secure element of the yubikey by means of a national security letter?
… Continue reading Can the private key inside a yubikey be known to anyone, e.g. the NSA?
I am running a secure design for a customer where I am required to implement passwordless access to machines by installing a secure smart card architecture that should allow synchronization with on-premise Active Directory domain users.
I … Continue reading YubiKey installation and synchronization with on-premise Microsoft AD domain users [closed]
I use a yubikey with device-generated ssh keys to login on my servers.
A few months ago I’ve created a ssh keypair on our cloud provider (OVH) with this value (truncated):
ecdsa-sha2-nistp256 AAAA…oYuQ= cardno:123
ssh-ed25519 AAAA…dOjE… Continue reading SSH ecdsa-sha2 key changed?
I use a yubikey with device-generated ssh keys to login on my servers.
A few months ago I’ve created a ssh keypair on our cloud provider (OVH) with this value (truncated):
ecdsa-sha2-nistp256 AAAA…oYuQ= cardno:123
ssh-ed25519 AAAA…dOjE… Continue reading SSH ecdsa-sha2 key changed?
How are the above devices built and what is the mechanism that seals them off from giving out private keys? Are the sign/decrypt operations somehow soddered into their hardware, is it a tiny piece of software which only API is to perform t… Continue reading What mechanism stops smartcards and YubiKeys from exporting private keys?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. This question’s answer suggests to me that… Continue reading When is FIPS certification important?
My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on the actual hardware key itself.
My unde… Continue reading Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?
I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I’d like to use the Yubikey as an alternative: instead of using the password, I could instead use the Yub… Continue reading Security of using Yubikey to derive Diceware password?
I recently set up two yubikeys based on this guide. I also set it up so gpg-agent is my ssh-agent, so I can use the keys for ssh. For some reason, even without me taking any action after plugging in the key (or rebooting, or coming back fr… Continue reading How to figure out what is requesting access to my yubikey?
I’m having the same issue of this fellow user.
I have a certificate stored in the Windows user personal store and in a YubiKey. When I plug the YubiKey, the Certificate Propagation Service discovers the certificates in the PIV applet and a… Continue reading Windows Certificate Propagation Service configuration