Skip to main content

YubiKey









YubiKey


From Wikipedia, the free encyclopedia
  (Redirected from Yubico)

Jump to navigation
Jump to search






























Yubico Inc.
Type
 Private
Industry Software
Founded 2007
Headquarters
Palo Alto, California,
United States
Key people
Stina Ehrensvärd
(founder and CEO)
Jakob Ehrensvärd
(CTO)
Website yubico.com



YubiKey 4 and YubiKey 4 Nano USB devices


The YubiKey is a hardware authentication device manufactured by Yubico that supports one-time passwords, public-key encryption and authentication, and the Universal 2nd Factor (U2F) protocol[1] developed by the FIDO Alliance (FIDO U2F). It allows users to securely log into their accounts by emitting one-time passwords or using a FIDO-based public/private key pair generated by the device. YubiKey also allows for storing static passwords for use at sites that do not support one-time passwords.[2]Facebook uses YubiKey for employee credentials,[3] and Google supports it for both employees and users.[4][5] Some password managers support YubiKey.[6][7] Yubico also manufactures the Security Key, a device similar to the YubiKey, but focused on public-key authentication.[8][9]


The Yubikey implements the HMAC-based One-time Password Algorithm (HOTP) and the Time-based One-time Password Algorithm (TOTP), and identifies itself as a keyboard that delivers the one-time password over the USB HID protocol. The YubiKey NEO and YubiKey 4 include protocols such as OpenPGP card using 2048-bit RSA and elliptical curve cryptography (ECC) p256 and p384, Near Field Communication (NFC), and FIDO U2F. The YubiKey allows users to sign, encrypt and decrypt messages without exposing the private keys to the outside world. The 4th generation YubiKey launched on November 16, 2015. It has support for OpenPGP with 4096-bit RSA keys, and PKCS#11 support for PIV smart cards, a feature that allows for code signing of Docker images.[10][11]


Founded in 2007 by CEO Stina Ehrensvärd, Yubico is a private company with offices in Palo Alto, Seattle, and Stockholm.[12] Yubico CTO, Jakob Ehrensvärd, is the lead author of the original strong authentication specification that became known as Universal 2nd Factor (U2F).[13]




Contents






  • 1 History


  • 2 ModHex


  • 3 YubiKey 4 security concerns


  • 4 See also


  • 5 References


  • 6 External links





History[edit]


Yubico was founded in 2007 and began offering a Pilot Box for developers in November of that year.[14] The original YubiKey product was shown at the annual RSA Conference in April 2008,[15][16] and a more robust YubiKey II model was launched in 2009.[17]


YubiKey II and later models have two "slots" available, for storing two distinct configurations with separate AES secrets and other settings. When authenticating the first slot is used by only briefly pressing the button on the device, while the second slot gets used when holding the button for 2 to 5 seconds.


In 2010, Yubico began offering the YubiKey OATH and YubiKey RFID models. The YubiKey OATH added the ability to generate 6- and 8-character one-time passwords using protocols from the Initiative for Open Authentication (OATH), in addition to the 32-character passwords used by Yubico's own OTP authentication scheme. The Yubikey RFID model included the OATH capability plus also included a MIFARE Classic 1k radio-frequency identification chip,[18] though that was a separate device within the package that could not be configured with the normal Yubico software over a USB connection.[19]


Yubico announced the YubiKey Nano in February 2012, a miniaturized version of the standard YubiKey which was designed so it would fit almost entirely inside a USB port and only expose a small touch pad for the button.[20] Most later models of the YubiKey have also been available in both standard and "nano" sizes.


2012 also saw the introduction of the YubiKey Neo, which improved upon the previous YubiKey RFID product by implementing near-field communication (NFC) technology and integrating it with the USB side of the device.[21] The YubiKey Neo (and Neo-n, a "nano" version of the device) are able to transmit one-time passwords to NFC readers as part of a configurable URL contained in a NFC Data Exchange Format (NDEF) message. The Neo is also able to communicate using the CCID smart-card protocol in addition to USB HID (human interface device) keyboard emulation. The CCID mode is used for PIV smart card and OpenPGP support, while USB HID is used for the one-time password authentication schemes.[22]


In 2014, the YubiKey Neo was updated with FIDO Universal 2nd Factor (U2F) support.[23] Later that year, Yubico released the FIDO U2F Security Key, which specifically included U2F support but none of the other one-time password, static password, smart card, or NFC features of previous YubiKeys.[8] At launch, it was correspondingly sold at a lower price point of just $18, compared to $25 for the YubiKey Standard ($40 for the Nano version), and $50 for the YubiKey Neo ($60 for Neo-n).[24] Some of the pre-release devices issued by Google during FIDO/U2F development reported themselves as "Yubico WinUSB Gnubby (gnubby1)".[25]


In April 2015, the company launched the YubiKey Edge in both standard and nano form factors. This slotted in between the Neo and FIDO U2F products feature-wise, as it was designed to handle OTP and U2F authentication, but did not include smart card or NFC support.[26]


The YubiKey 4 family of devices was first launched in November 2015, with USB-A models in both standard and nano sizes. The YubiKey 4 includes most features of the YubiKey Neo, including increasing the allowed OpenPGP key size to 4096 bits (vs. the previous 2048), but dropped the NFC capability of the Neo.


At CES 2017, Yubico announced an expansion of the YubiKey 4 series to support a new USB-C design. The YubiKey 4C was released on February 13, 2017.[27] On Android OS over the USB-C connection, only the one-time password feature is supported by the Android OS and YubiKey, with other features not currently supported including Universal 2nd Factor (U2F).[28] A 4C Nano version became available in September 2017.[29]


In April 2018, the company brought out the Security Key by Yubico, their first device to implement the new FIDO2 authentication protocols, WebAuthn (which reached W3C Candidate Recommendation status in March[30]) and Client to Authenticator Protocol (CTAP, still under development as of May 2018). At launch, the device is only available in the "standard" form factor with a USB-A connector. Like the previous FIDO U2F Security Key, it is blue in color and uses a key icon on its button. It is distinguished by a number "2" etched into the plastic between the button and the keyring hole. It is also less expensive than the YubiKey Neo and YubiKey 4 models, costing $20 per unit at launch because it lacks the OTP and smart card features of those previous devices, though it retains FIDO U2F capability.[9]



ModHex[edit]


When being used for one-time passwords and stored static passwords, the YubiKey emits characters using a modified hexadecimal alphabet which is intended to be as independent of system keyboard settings as possible. This alphabet, referred to as ModHex or Modified Hexadecimal, consists of the characters "cbdefghijklnrtuv", corresponding to the hexadecimal digits "0123456789abcdef".[31] Due to YubiKeys using raw keyboard scan codes in USB HID mode, there can be problems when using the devices on computers that are set up with different keyboard layouts, such as Dvorak. It is recommended to either use operating system features to temporarily switch to a standard US keyboard layout (or similar) when using one-time passwords, although YubiKey Neo and later devices can be configured with alternate scan codes to match layouts that aren't compatible with the ModHex character set.[32]


U2F authentication in YubiKeys and Security Keys bypasses this problem by using the alternate U2FHID protocol, which sends and receives raw binary messages instead of keyboard scan codes.[33] CCID mode acts as a smart card reader, which does not use HID protocols at all.



YubiKey 4 security concerns[edit]


Yubico has replaced all open-source components in YubiKey 4 with closed-source code, which can no longer be independently reviewed for security flaws.[34] Yubico states that internal and external review of their code is done. Yubikey NEOs are still using open-source code.[35] On May 16, 2016, Yubico CTO Jakob Ehrensvärd responded to the open-source community's concerns with a blog post[36] affirming the company's strong open source support and addressing the reasons and benefits of updates to the YubiKey 4.


In October 2017, security researchers found a vulnerability (known as ROCA) in the implementation of RSA keypair generation in a cryptographic library used by a large number of Infineon security chips. The vulnerability allows an attacker to reconstruct the private key by using the public key.[37][38] All YubiKey 4, YubiKey 4C, and YubiKey 4 Nano devices within the revisions 4.2.6 to 4.3.4 are affected by this vulnerability.[39] Yubico publicized a tool to check if a Yubikey is affected and replaced affected tokens for free.[40]



See also[edit]


  • OpenPGP card


References[edit]





  1. ^ "Specifications Overview". FIDO Alliance. Retrieved 4 December 2015..mw-parser-output cite.citation{font-style:inherit}.mw-parser-output .citation q{quotes:"""""""'""'"}.mw-parser-output .citation .cs1-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/6/65/Lock-green.svg/9px-Lock-green.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .citation .cs1-lock-limited a,.mw-parser-output .citation .cs1-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/d/d6/Lock-gray-alt-2.svg/9px-Lock-gray-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .citation .cs1-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/a/aa/Lock-red-alt-2.svg/9px-Lock-red-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration{color:#555}.mw-parser-output .cs1-subscription span,.mw-parser-output .cs1-registration span{border-bottom:1px dotted;cursor:help}.mw-parser-output .cs1-ws-icon a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/4/4c/Wikisource-logo.svg/12px-Wikisource-logo.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output code.cs1-code{color:inherit;background:inherit;border:inherit;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;font-size:100%}.mw-parser-output .cs1-visible-error{font-size:100%}.mw-parser-output .cs1-maint{display:none;color:#33aa33;margin-left:0.3em}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration,.mw-parser-output .cs1-format{font-size:95%}.mw-parser-output .cs1-kern-left,.mw-parser-output .cs1-kern-wl-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right,.mw-parser-output .cs1-kern-wl-right{padding-right:0.2em}


  2. ^ "What Is A Yubikey". Yubico. Retrieved 7 November 2014.


  3. ^ McMillan (3 October 2013). "Facebook Pushes Passwords One Step Closer to Death". Wired. Retrieved 7 November 2014.


  4. ^ Diallo, Amadou (30 November 2013). "Google Wants To Make Your Passwords Obsolete". Forbes. Retrieved 15 November 2014.


  5. ^ Blackman, Andrew (15 September 2013). "Say Goodbye to the Password". The Wall Street Journal. Archived from the original on 3 January 2014. Retrieved 15 November 2014.


  6. ^ "YubiKey Authentication". LastPass. Retrieved 15 November 2014.


  7. ^ "KeePass & YubiKey". KeePass. Retrieved 15 November 2014.


  8. ^ ab "Yubico Releases FIDO U2F Security Key". Yubico (Press release). 2014-10-21. Retrieved 2018-05-05.


  9. ^ ab "Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications" (Press release). 2018-04-10. Retrieved 2018-05-06.


  10. ^ "Launching The 4th Generation YubiKey". Yubico. Retrieved 20 November 2015.


  11. ^ "With a Touch, Yubico, Docker Revolutionize Code Signing". Yubico. Retrieved 20 November 2015.


  12. ^ "The Team". Yubico. Retrieved 12 September 2015.


  13. ^ "History of FIDO". FIDO Alliance. Retrieved 16 March 2017.


  14. ^ "Yubico launches YubiKey Pilot Box". Yubico. 2007-11-26. Archived from the original on 2008-02-21.


  15. ^ Steve Gibson (April 2008). "Security Now! Notes for Episode #141". Security Now!. Gibson Research Corporation. Retrieved 2018-05-05.


  16. ^ Leo Laporte and Steve Gibson (2008-04-24). "Episode #141 - RSA Conference 2008". Security Now!. Gibson Research Corporation. Retrieved 2018-05-05.


  17. ^ Mike (2009-08-27). "Yubikey II – got it". Read My Damn Blog. Retrieved 2018-05-05.


  18. ^ "RFID YubiKey". Yubico Store. Archived from the original on 2011-08-29. Retrieved 2018-05-05.


  19. ^ "RFID YubiKey". IDivine Technology. Retrieved 2018-05-05.


  20. ^ "Yubico Launches YubiKey Nano, The World's Smallest One-Time Password Token" (Press release). Yubico. 2012-02-28. Retrieved 2018-05-05.


  21. ^ Clark, Sarah (2012-02-22). "Yubico introduces one-time password token that secures access to the contents of NFC phones". NFC World. Retrieved 2018-05-05.


  22. ^ Maples, David (2012-12-26). "YubiKey NEO Composite Device". Yubico. Retrieved 2018-05-05.


  23. ^ "Yubico Introduces Industry's First FIDO Ready™ Universal 2nd Factor Device". Yubico (Press release). 2014-01-06. Retrieved 2018-05-05.


  24. ^ "YubiKey Hardware". Yubico. Archived from the original on 2014-11-07.


  25. ^ "pamu2fcfg doesn't support test devices".


  26. ^ "Yubico Launches YubiKey Edge at RSA 2015; OTP and U2F Two-Factor Authentication in One Key". Yubico (Press release). Retrieved 2018-05-05.


  27. ^ "NEW YubiKey 4C featuring USB-C revealed at CES 2017 | Yubico". Yubico. 2017-01-05. Retrieved 2017-09-14.


  28. ^ "Can the YubiKey 4C be plugged directly into Android phones or tablets with USB-C ports? | Yubico". Yubico. Retrieved 2017-09-14.


  29. ^ "Our Family is Growing! YubiKey 4C Nano Unveiled at Microsoft Ignite". Yubico. 2017-09-25. Retrieved 2018-05-05.


  30. ^ Jones, Michael (2018-03-20). "Candidate Recommendation (CR) for Web Authentication Specification". W3C Web Authentication Working Group. Retrieved 2018-05-06.


  31. ^ E, Jakob (12 June 2008). "Modhex - why and what is it?". Yubico. Retrieved 6 November 2016.


  32. ^ Toh, Alvin (2013-07-24). "Expanding YubiKey Keyboard Support". Yubico. Retrieved 2018-05-05.


  33. ^ "FIDO U2F HID Protocol Specification". FIDO Alliance. 2017-04-11. Retrieved 2018-05-06.


  34. ^ Ryabitsev, Konstantin. "I must, sadly, withdraw my endorsement of yubikey 4 devices (and perhaps all ..." Google+. Retrieved 12 November 2016.


  35. ^ "dainnilsson commented on 11 May". Github. Retrieved 12 November 2016.


  36. ^ "Secure Hardware vs. Open Source". Yubico.com. Retrieved 16 March 2017.


  37. ^ "ROCA: Vulnerable RSA generation (CVE-2017-15361) [CRoCS wiki]". crocs.fi.muni.cz. Retrieved 2017-10-19.


  38. ^ "NVD - CVE-2017-15361". nvd.nist.gov. Retrieved 2017-10-19.


  39. ^ "Infineon RSA Key Generation Issue - Customer Portal". www.yubico.com. Retrieved 2017-10-19.


  40. ^ "Infineon RSA Key Generation Issue - Customer Portal". www.yubico.com. Retrieved 2017-10-19.




External links[edit]



  • Official website

  • YubiKey 5 comparison table

  • YubiKey FIPS comparison table






Retrieved from "https://en.wikipedia.org/w/index.php?title=YubiKey&oldid=879496743"





Navigation menu


























(window.RLQ=window.RLQ||).push(function(){mw.config.set({"wgPageParseReport":{"limitreport":{"cputime":"0.420","walltime":"0.497","ppvisitednodes":{"value":1984,"limit":1000000},"ppgeneratednodes":{"value":0,"limit":1500000},"postexpandincludesize":{"value":58360,"limit":2097152},"templateargumentsize":{"value":699,"limit":2097152},"expansiondepth":{"value":8,"limit":40},"expensivefunctioncount":{"value":0,"limit":500},"unstrip-depth":{"value":1,"limit":20},"unstrip-size":{"value":114711,"limit":5000000},"entityaccesscount":{"value":0,"limit":400},"timingprofile":["100.00% 434.933 1 -total"," 71.53% 311.127 1 Template:Reflist"," 48.36% 210.349 31 Template:Cite_web"," 23.40% 101.759 1 Template:Infobox_company"," 15.31% 66.603 1 Template:Infobox"," 6.49% 28.234 5 Template:Cite_press_release"," 5.52% 24.026 4 Template:Cite_news"," 5.35% 23.269 2 Template:Main_other"," 2.86% 12.421 1 Template:Br_separated_entries"," 2.05% 8.917 1 Template:Url"]},"scribunto":{"limitreport-timeusage":{"value":"0.244","limit":"10.000"},"limitreport-memusage":{"value":4004054,"limit":52428800}},"cachereport":{"origin":"mw1232","timestamp":"20190121170157","ttl":1900800,"transientcontent":false}}});mw.config.set({"wgBackendResponseTime":97,"wgHostname":"mw1325"});});
-

Popular posts from this blog

Florida Star v. B. J. F.

Image
Florida Star v. B. J. F. From Wikipedia, the free encyclopedia Jump to navigation Jump to search United States Supreme Court case Florida Star v. B. J. F. Supreme Court of the United States Argued March 21, 1989 Decided June 21, 1989 Full case name The Florida Star v. B. J. F. Citations 491 U.S. 524 ( more ) 109 S. Ct. 2603; 105 L. Ed. 2d 443; 1989 U.S. LEXIS 3120; 57 U.S.L.W. 4816; 16 Media L. Rep. 1801 Prior history The Florida Star v. B.J.F., 530 So.2d 286 (1988) Supreme Court of Florida; Florida Star v. B.J.F., 499 So.2d 883 (1986) Fla. Dist. Court of Appeals Holding Florida Stat. § 794.03 is unconstitutional to the extent it makes the truthful reporting of information that was a matter of public record unlawful, as it violates the First Amendment. Court membership Chief Justice William Rehnquist Associate Justices William J. Brennan Jr.  · Byron White Thurgood Marshall  · Harry Blac...
Read more

Danny Elfman

Image
Danny Elfman From Wikipedia, the free encyclopedia Jump to navigation Jump to search Danny Elfman Elfman at the 2010 San Diego Comic-Con Born Daniel Robert Elfman ( 1953-05-29 ) May 29, 1953 (age 65) Los Angeles, California, U.S. Spouse(s) Bridget Fonda ( m.  2003) Children 1 Musical career Genres Rock [1] ska [2] new wave film music video game music Occupation(s) Composer, singer, songwriter, record producer Instruments Trombone guitar percussion vocals keyboards [3] Years active 1972–present Associated acts Oingo Boingo James Newton Howard Daniel Robert Elfman (born May 29, 1953) is an American composer, singer, songwriter, and record producer. Elfman first became known for being the lead singer and songwriter for the band Oingo Boingo from 1974 to 1995. He is well known for scoring films and television shows, particularly his frequent collabora...
Read more

Lugert, Oklahoma

Image
Unincorporated community in Oklahoma, United States Lugert, Oklahoma Unincorporated community Foundations from the town of Lugert at the bottom of Lake Altus-Lugert Lugert, Oklahoma Location within the state of Oklahoma Coordinates: 34°53′45″N 99°16′31″W  /  34.89583°N 99.27528°W  / 34.89583; -99.27528 Coordinates: 34°53′45″N 99°16′31″W  /  34.89583°N 99.27528°W  / 34.89583; -99.27528 Country United States State Oklahoma County Kiowa Time zone UTC-6 (Central (CST))  • Summer (DST) UTC-5 (CDT) GNIS feature ID 1100597 Lugert is an unincorporated community in Kiowa County, Oklahoma. [1] The town of Lugert was founded in 1901 on 80 acres (320,000 m 2 ). In the town, there was a general store that housed the Post office and sold dry goods, school supplies, groceries, harnesses, axes and much more. It was named for Frank Lugert, who had moved to the area in 1898. Lugert owned land where the town was sited and also owned the general st...
Read more