Yubico Forum

YubiKey 4 • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

YubiKey 4 • YubiKey 4 on MAC - ABORT has been sent to the transform

2018-01-24T11:30:14+01:00

Hi,

I am trying to sign some data with the certificate PrivateKey ( Certificate was loaded into slot 9c(Digital signature) on My YubiKey4 using Yubikey PIV Manager v1.4.2) on Mac High Sierra.

Below OSX APIs were used to sign the data using the certificate,

Code:

    SecTransformRef signingTransform = NULL;
    signingTransform = SecSignTransformCreate(privateKeyRef, NULL);
    NSString *stingSign = @"Some string";
    CFDataRef sourceData = CFDataCreate(
                                        kCFAllocatorDefault,
                                        (const unsigned char *)[stingSign UTF8String],
                                        stingSign.length
                                        );
    CFErrorRef error = NULL;
    SecTransformSetAttribute(
                             signingTransform,
                             kSecTransformInputAttributeName,
                             sourceData,
                             &error);
    if (error)
      {
        NSLog(@"Error : %@",[((__bridge NSError*)error) description]);
      }
   ..... Remaining execution code goes here

but i am getting

Quote:

Error : Error Domain=com.apple.security.transforms.error Code=20 "ABORT has been sent to the transform (Error Domain=Internal CSSM error Code=-25304 "Internal error #ffff9d28 at SignTransform_block_invoke /BuildRoot/Library/Caches/com.apple.xbs/Sources/Security/Security-58286.31.2/OSX/libsecurity_transform/lib/SecSignVerifyTransform.c:411" UserInfo={NSDescription=Internal error #ffff9d28 at SignTransform_block_invoke /BuildRoot/Library/Caches/com.apple.xbs/Sources/Security/Security-58286.31.2/OSX/libsecurity_transform/lib/SecSignVerifyTransform.c:411, Originating Transform=CoreFoundationObject})" UserInfo={NSDescription=ABORT has been sent to the transform (Error Domain=Internal CSSM error Code=-25304 "Internal error #ffff9d28 at SignTransform_block_invoke /BuildRoot/Library/Caches/com.apple.xbs/Sources/Security/Security-58286.31.2/OSX/libsecurity_transform/lib/SecSignVerifyTransform.c:411" UserInfo={NSDescription=Internal error #ffff9d28 at SignTransform_block_invoke /BuildRoot/Library/Caches/com.apple.xbs/Sources/Security/Security-58286.31.2/OSX/libsecurity_transform/lib/SecSignVerifyTransform.c:411, Originating Transform=CoreFoundationObject})}

Do I need to do any extra configuration to execute this code? or am I missing something while setup? same code is working fine if I sign with the same certificate on eToken smartcard.

Please help us.

Statistics: Posted by Murali — Wed Jan 24, 2018 11:30 am

YubiKey 4 • Occurred while decrypting a message the hand is invalid

2018-01-22T13:17:17+01:00

Hi,

When trying open a keepass database protected with a certificate on the yubikey into a 2008R2 (inside a ICA session citrix XenApp 6.5), i run across the following message :

An error occurred while decrypting a message: The handle is invalid.

First i have the PIN prompt and after PIN validation, i have the error as you can see on the image.

It work very well inside a RDP session on the same server !
And it works also in a ICA session citrix XenApp version 7.9 !

When i use putty and pageant wincrypt, i have the following error :
__________________________________________________________________________________________
login as: root
Authenticating with public key "cert://cn=adminrescue,thumbprint=6786370c2e56f50 6679a116758951a1e0cd7686d" from agent
Server refused public-key signature despite accepting key!
Using keyboard-interactive authentication.
Password:
__________________________________________________________________________________________

it tells me incorrect signature ???

Can you help me to track what's going wrong ?

Thanks

Statistics: Posted by gg94700 — Mon Jan 22, 2018 1:17 pm

YubiKey 4 • S/MIME basics

2018-01-19T13:06:51+01:00

Hi, first post here

I am using SMIME certificate on Yubikey for a year now. Now i need to exchange it for a renewed one. Two questions I have:

1. Why in all docs it says that "certificate" is on the yubikey, nothing about "private key", even though it also is there? Is the term "certificate" used for a package of public+private key, not only public one?
2. How do I save new smime cert while retaining the old one for stored mail decryption?

Cheers!

Statistics: Posted by woocash — Fri Jan 19, 2018 1:06 pm

YubiKey 4 • Re: Question Regarding minidriver announcement.

2018-01-17T19:34:34+01:00

Blocking the minidriver from installing is covered in the deployment guide, page 32 (last page). No, it's not part of a KB.

https://www.yubico.com/wp-content/uploa ... 7_RevB.pdf

Statistics: Posted by ChrisHalos — Wed Jan 17, 2018 7:34 pm

YubiKey 4 • Re: Question Regarding minidriver announcement.

2018-01-17T11:31:49+01:00

maggis wrote:

What offends me most, is that the exact update name/KB has never been listed anywhere that I can find.

So how can I un-approve it in WSUS??

are drivers even KBs?

iirc drivers are a bit different than normal updates.

Statistics: Posted by My1 — Wed Jan 17, 2018 11:31 am

YubiKey 4 • Re: Question Regarding minidriver announcement.

2018-01-17T10:44:52+01:00

What offends me most, is that the exact update name/KB has never been listed anywhere that I can find.

So how can I un-approve it in WSUS??

Statistics: Posted by maggis — Wed Jan 17, 2018 10:44 am

YubiKey 4 • Re: windows 10 1703 minidriver update breaks PIV

2018-01-17T10:05:25+01:00

So, do you have any recommended tips to fix this ?
currently, I am using smart card Yubico and my laptop was installed this driver automatically then I need to login PC using password and remove it first to be able login PC using smart card.

Statistics: Posted by lsichoeum — Wed Jan 17, 2018 10:05 am

YubiKey 4 • Re: Need help in loading my new Yubikey 4

2018-01-16T22:28:18+01:00

Open Yubico Authenticator and make sure the app isn't covering the QR code displayed in your Bitstamp account (https://www.bitstamp.net/article/update ... uthentica/). From Yubico Authenticator, File > Scan QR code.

Statistics: Posted by ChrisHalos — Tue Jan 16, 2018 10:28 pm

YubiKey 4 • Re: Need help in loading my new Yubikey 4

2018-01-16T17:32:28+01:00

Hello Julemand . . .

Thank you for replying. My problem is as follows . . .

I have spent over 12 hours trying to make the Yubikey work to no avail. I have tried every possible source on the net and cannot find any guide that starts with a “step 1” so to speak. Desperately need some advice so I can proceed and use the key. Please help!!

Inserted the key and it said no credential added –

Tried the demo to set credentials as explained at demo.yubico.com and it worked without any problems.

Tried to set credentials on the Yubico Authenticator and it was a completely different platform to set credentials asking for a secret key, etc.

So assuming I need to set my credentials in order to use the key, how do I do this?

I need this for 2FA on Bitstamp and other sites.

Also, noted the “personalization tool” and is this the necessary first step??? For Bitstamp and other sites I assume I need the OTP mode?? Please clarify.

I had tried to add a credential for Bitstamp and followed the instructions in the User’s Guide (2016 Yubico) on page 11 and this did not work either.

Any help you can offer would be greatly appreciated!

Many thanks,
David

Statistics: Posted by mamba1 — Tue Jan 16, 2018 5:32 pm

YubiKey 4 • Re: Need help in loading my new Yubikey 4

2018-01-16T13:43:34+01:00

Hi David,

Could you try explain what you are trying to achieve? It is a little unclear what you mean by "in order to provide the requested security from sites I deal with". Yubikey 4 does support a range of different ways to provide security so I need to know a little more before I can guide you.

Statistics: Posted by julemand101 — Tue Jan 16, 2018 1:43 pm

YubiKey 4 • Need help in loading my new Yubikey 4

2018-01-15T19:44:36+01:00

Dear Friends,

I have spent the past 8 hours trying to load my Yubikey 4, in order to provide the requested security from sites I deal with.

No matter what I try I am unable to make it function correctly.

I am not really computer savvy, so if possible I would sincerely appreciate help with my seemingly insurmountable task!

Kind regards,

David

Statistics: Posted by mamba1 — Mon Jan 15, 2018 7:44 pm

YubiKey 4 • Re: Locked out of Macbook

2018-01-10T16:50:52+01:00

Solved

Followed this tutorial: https://vcsjones.com/2016/01/21/regaining-access-to-os-x-after-a-lost-yubikey/

Statistics: Posted by justinwagg — Wed Jan 10, 2018 4:50 pm

YubiKey 4 • Re: Support for EdDSA

2018-01-09T19:14:05+01:00

no plans currently

Statistics: Posted by ChrisHalos — Tue Jan 09, 2018 7:14 pm

YubiKey 4 • Locked out of Macbook

2018-01-09T17:11:49+01:00

Hello,

Hope you are well.

I set my Yubikey up as a method of logging into my Mac by following the steps in this pdf:
https://www.yubico.com/wp-content/uploads/2016/02/Yubico_YubiKeyMacOSXLogin_en.pdf

I seem to have locked myself out of, or disabled the PIN somehow .

When I boot my machine, I am first prompted for my actual password, which upon entering it, another login window appears asking for PIN. Even though I am entering the correct PIN, which worked previously in testing, I can not unlock my computer.

Are there steps I can use to troubleshoot/disable the PIN?

I attempted to boot into recovery mode and remove the lines I added in

Code:

/etc/pam.d/screensaver

and

Code:

/etc/pam.d/authorization

but in recovery mode it doesn't look like those edits are even there.

Any tips would be greatly appreciated.

Thanks,
Justin

Statistics: Posted by justinwagg — Tue Jan 09, 2018 5:11 pm