YubiKey

from Wikipedia, the free encyclopedia
Yubico Inc.
legal form Corporation
founding 2007
Seat Palo Alto , USA
management Stina Ehrensvärd
(Founder and CEO)
Jakob Ehrensvärd
( CTO )
Branch software
Website www.yubico.com

YubiKey 4 on the key ring and next to it the Nano design

The YubiKey is a security token from Yubico that is used with interfaces such as Near Field Communication (NFC) or USB and various protocols to identify and authenticate users on computer systems. Among other things, it allows secure passwordless authentication. Yubico uses open source software such as OpenPGP and open standards such as U2F for two-factor authentication for the Microsoft Windows , macOS and Linux operating systems . For security reasons, software on YubiKey can neither be read nor changed. In the event of an update, the device must be replaced by a new model. Secret private key data can be generated on the token or written to the token, but not subsequently read out.

Since the YubiKey hardware - in contrast to competing products such as the Nitrokey family from Nitrokey or the Solo family from SoloKeys - is not open source , independent tests for backdoors or security gaps are hardly possible.

construction

YubiKeys are housed in waterproof housings. They contain a USB port with USB-A connector or the newer USB-C connector as the primary interface . The button on the security token required for some operating modes to confirm an action is designed as a sensor button with no mechanically moving parts. YubiKey Neo and YubiKey 5 include a contactless NFC interface, and the power supply for the YubiKey is also provided via NFC. The range of functions is identical for both interfaces.

The YubiKey 4 and YubiKey NEO models use a microcontroller from NXP Semiconductors . In the successor model YubiKey 5, the number of components has been reduced. The used crypto processor from Infineon type SLE 78CLUFX5000PH allows Sicherheitszertifizierbarkeit to stage EAL6 . It is protected against read-out of saved memories and all interfaces such as USB connection and NFC interface.

Logs

YubiKeys can emulate three different types of virtual USB devices via the USB interface and thus offer a wide range of functions: OTP , FIDO and CCID . The three USB protocols can be combined with each other or, if not required, can also be deactivated.

The USB protocol OTP, derived from the term one-time pad, represents the original USB protocol for security token. It allows the YubiKey the configuration of two so-called slots , German about storage locations . Each slot can independently accommodate a function including the necessary data such as secret keys. With YubiKey 4 these are the following options for OTP:

The respective OTP function can or must be linked to the sensor key, i. H. to release one expresses one's consent by pressing a button. Depending on how long you press the button, the function is triggered from slot 1 or slot 2.

With the USB protocol FIDO (for FIDO Alliance ), the YubiKey provides the Universal Second Factor ( U2F ). The Yubico FIDO model only offers the FIDO USB protocol. The U2F procedure requires the confirmation of the user on the token, as otherwise the token refuses the U2F response. This function is taken over by the sensor key, which must be pressed once for each U2F action. In the context of U2F, in contrast to other operational data, no user-specific data is stored on the token. YubiKey 5 also supports the W3C standard WebAuthn , which is part of the FIDO2 project and is based on U2F and UAF ( English Universal Authentication Framework ).

With the third USB protocol CCID , the YubiKey emulates a chip card reader on the USB port and offers unchangeable smart card applications programmed by the manufacturer that comply with the ISO 7816 chip card standard . The following CCID applications, among others, are available on the YubiKey 4 (these require appropriate software on the host system):

  • OATH HOTP: identical to the basic OTP function, but up to 32 configurations are possible
  • OATH TOTP . Since YubiKey does not contain a clock for calculating one-time passwords, the current system time is transferred to the emulated chip card program OATH TOTP via CCID. Up to 32 configurations are possible.
  • OpenPGP Smart Card version 2.0
  • A personal identity verification according to FIPS 201 , which is used by US authorities to establish identity.

Security issues

In October 2017 it became known that the CCID application OpenPGP, which is used, among other things, for the YubiKey 4 is based on the defective RSALib software library from Infineon , which makes the generation of RSA key pairs directly on the token susceptible to ROCA vulnerability . Yubico replaced affected devices with new YubiKeys free of charge.

The plastic housing of the first YubiKey versions such as YubiKey Neo could easily be chemically dissolved in boiling acetone . This made the printed circuit board accessible without being destroyed. Although no data could be read from the integrated circuits from NXP Semiconductors , a different plastic was used in later generations such as YubiKey 5.

Web links

Individual evidence

  1. ↑ Free and Open Source Tools. Retrieved December 29, 2018 .
  2. ↑ Upgrading YubiKey firmware. Retrieved December 29, 2018 .
  3. ↑ Nitrokey | Secure your digital life. Accessed January 30, 2020 .
  4. ↑ Solo - Solo Keys. Accessed December 24, 2019 .
  5. ↑ Inside Yubikey 5 Neo. Accessed December 30, 2018 .
  6. ↑ YubiKey 4 Technical Specifications. Retrieved December 29, 2018 .
  7. ↑ Introducing the YubiKey 5 Series with New NFC and FIDO2 Passwordless Features. Accessed December 31, 2018 .
  8. ^ The OpenPGP card. Retrieved December 29, 2018 .
  9. ↑ ROCA: Vulnerable RSA generation (CVE-2017-15361) [CRoCS wiki ] ( en )
  10. ^ Infineon RSA Key Generation Issue - Customer Portal .
  11. ↑ Inside Yubikey Neo. Retrieved December 29, 2018 .