Yubico Forum

Re: Reusing OTP passwords

2009-02-15T08:44:00+01:00

Quote:

I'm not from yubico, but I read and don't understand your concerns exactly. They check in repo changes as they are made.. I don't think that the source code repository is intended as a product of commercial quality, but rather a tool for the community.

I could be wrong.

The Yubico public validation server runs off the key subsystem code in the public repository. The changes to the source that concerned me were made by a Yubico employee.

It's not unreasonable to expect the proper handling of tokens and OTPs in source that is created by the company selling the tokens. It's pretty hard to imagine any other token vendor exposing such borderline cavalier behavior to code correctness.

If you don't understand why the way Yubico deals with this bug -- its initial introduction by quick-and-dirty untested code changes and its subsequent attempt to fix by equally untested code change and complete silence on these facts when challenged -- is very dangerous, then I'm sorry but you don't understand enough about security and should be looking for a different solution.

Unless the Yubikey is just a toy, in which case shame on me for thinking otherwise.

Statistics: Posted by zzap — Sun Feb 15, 2009 8:44 am

Re: Reusing OTP passwords

2009-02-10T20:51:43+01:00

zzap wrote:

Not to harp on this, but I am concerned no one from Yubico bothers to address my concerns. Is there really no interest from Yubico's side in explaining why the source code changes were made in the way they were?

Statistics: Posted by ferrix — Tue Feb 10, 2009 8:51 pm

Re: Reusing OTP passwords

2009-02-10T16:44:40+01:00

Statistics: Posted by zzap — Tue Feb 10, 2009 4:44 pm

Re: Reusing OTP passwords

2009-02-08T22:21:39+01:00

zzap wrote:

But for an attacker it doesn't matter if the token is present, of course.

Yubico people: The way you described this bug causes a lot of confusion because of this counter intuitive notion about sessions. You should clarify and remember that your users do not begin with an understanding of the internal details of your algorithms!

I am going to try re-stating the bug cases in a different way to see if it is any easier to understand. Please correct me if I'm wrong:

This bug has nothing to do with whether the key is plugged in at the time of attack. A more clear way to state it is: if you always follow the behavior to only generate one OTP at a time and then unplug your key, the OTPs you generate will never trigger the bug case in the service. Therefore, an attacker who has access to all those OTP strings will not find them at all useful, since they cannot cause the server bug.

But any time you generate more than one OTP while still leaving the key plugged in, then those OTPs are of a kind that could trigger the bug. An attacker who collects those OTPs could use one or more of them as valid in the future. Once you plug in and validate the real key again, that last attack window closes. It causes the replayable OTPs "expire" so to speak.

Anyway, all this will be moot with the fixed server code. I am only trying to help increase understanding about the nature and scope of the found bug.

Statistics: Posted by ferrix — Sun Feb 08, 2009 10:21 pm

Re: Reusing OTP passwords

2009-02-08T19:03:18+01:00

But for an attacker it doesn't matter if the token is present, of course.

The original error seems to be the odd commenting out of OTP checking code in
http://code.google.com/p/yubikey-server ... =side&r=32

Any comments on that?

Statistics: Posted by zzap — Sun Feb 08, 2009 7:03 pm

Re: Reusing OTP passwords

2009-02-08T08:09:17+01:00

Update on the fix that was applied.

The problem
The previous version did not properly detect OTPs generated within that same session where the Yubikey remains inserted in the USB slot. If the Yubikey was removed and then reinserted again and a new OTP is generated (most common use case) then OTPs from previous session were invalidated correctly and detected as replay attacks. However, for OTPs that were generated while the key remained inserted then OTPs within that session could be replayed without detection until next removal and insertion of the Yubikey. The reason was that the Yubikey counter for “session use” was not checked by the server.

The fix
A SessionUse variable was added and is now checked by the server in order to properly detect replays of OTPs within the same session where the Yubikey remains inserted while generating OTPs during the session.

The changes to the code can be reviewed following the links below.
http://code.google.com/p/yubikey-server ... tail?r=33#
http://code.google.com/p/yubikey-server ... tail?r=34#

Kurt L - Yubico Support

Statistics: Posted by Kurt — Sun Feb 08, 2009 8:09 am

Re: Reusing OTP passwords

2009-02-08T05:40:39+01:00

I can confirm this issue. In January I posted these same findings to the Gibson Research Corporation NetNews system. I have been concerned is issue is fixed.

Statistics: Posted by mgrennan — Sun Feb 08, 2009 5:40 am

Re: Reusing OTP passwords

2009-02-07T22:59:34+01:00

I agree this is a big deal. But it ends up being a fast fix, so good. I hope yubico goes into detail about how similar issues will be prevented.

The yubikey hardware design is pretty outstanding and has proven very robust, and any applications that don't rely on the yubico internet server (or software) wouldn't even be affected by this issue.

So the sky isn't totally falling here, even though it's certainly true that this is a big and embarrassing issue to be found. Perhaps based on this 'unexpected success' of the service as described by Jakob, it would be time to institute some formal QA or some sort of validation process. But at least the problem is handled with grace, openness and expedience. An open source community can forgive a lot as long as the vendor continues to be an honest partner with us and diligently address concerns.

(Edited to reflect new info evening of Feb 7)

Statistics: Posted by ferrix — Sat Feb 07, 2009 10:59 pm

Re: Reusing OTP passwords

2009-02-07T21:25:40+01:00

The Yubikey idea is really great, I wouldn't be here otherwise. I love that its not costly and it is something even my wife could use. The fact that the software is open-source also gives you an advantage over other OTP products. That said, I would like to see the software side of things managed better and with more structure. I'm sure your resources are limited, but if we could have a mailing list or forum board dedicated to the development of the authentication server that would be great. If you setup a QA/test server I would be willing to help test fixes (and I'm sure others would as well). One benefit of your quick growth is that you will have a bigger community to help with fixes, testing, etc. Of course we will also find bugs and scrutinize as well. This is all good and can and should lead to a better product if you let it.

Again, my concern is not so much about the software, I can fix that. My concern is the stability of Yubico as a company. How is the company doing? Will you be around in 2,5,10 years? I could potentially be purchasing quite a few Yubikeys for clients, but I need to know I am not leading them down the wrong path. If Yubico is ever in danger it would be nice to have the hardware specifications for the Yubikey released openly. Anyway, these questions probably belong in the "Other Questions" board.

Thanks for looking into the issue. If we decide to go with Yubikeys I will make sure to contribute whatever I can to the software.

Thanks.
Ryan

Statistics: Posted by ryan — Sat Feb 07, 2009 9:25 pm

Re: Reusing OTP passwords

2009-02-07T17:55:53+01:00

And the fix is just slapped in there, with no regression testing at all. And no new test cases. (See http://code.google.com/p/yubikey-server ... Tests.java)

How do you know that you're not opening up another can of worms? How do you have *any* idea that you've fully fixed the problem?

Looking at how changes are made, for example,
in http://code.google.com/p/yubikey-server ... svn34&r=32, with its commenting out of code to support new firmware while disintegrating older firmware + total absence of testing of the fix doesn't exactly inject a lot of confidence going forward.

Come on, you can do better!

Statistics: Posted by zzap — Sat Feb 07, 2009 5:55 pm

Re: Reusing OTP passwords

2009-02-07T11:22:10+01:00

This is a serious issue indeed and it is being fixed right now. It is certainly embarrassing and I understand everyone who gets upset that such a thing could happen.

I feel it is important to say that the current sever was initially designed as a "proof of concept" for trials and evaluation only. We were actually taken a bit by surprise that the service quickly became popular and that several people and organizations wanted to use it right away.

We have got several questions about availability/uptime, redundancy, security, physical protection, QA, auditing etc. and have therefore initiated the "next generation server" development project where we'll offer a premium service rather than just a "best effort" service. This service is targeted for launch at March 1st.

So we kindly ask everyone for a bit of patience. We'll ensure that this bug gets fixed now and keep your eyes open for the new service.

With the best regards,

Jakob E
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Sat Feb 07, 2009 11:22 am

Re: Reusing OTP passwords

2009-02-07T09:14:00+01:00

The bug has been isolated…

This is a description of what occurs.
OTP replays are currently not detected within the same session when a YubiKey is inserted in the USB port. But if the key is removed and reinserted between OTP generations (as with most normal usage), then any old OTPs generated during earlier sessions cannot be replayed .

Example: If a user inserts a YubiKey, and generates OTP 1, OTP 2, OTP 3 and again replays OTP 1 and/or OTP 2 in the same key insertion session (i.e. without removing and reinserting the Yubikey) the replay is not detected and a positive authentication response is generated. However, if the user removes and reinserts the YubiKey in the USB port (most normal usage) and generates OTP4 and then try to replay any of OTP 1 through OTP 3, they will be detected as replay and a negative authentication response will be generated.

Key inserted first time
OTP1 (Accepted in any order within same key insertion)
OTP2 (Accepted in any order within same key insertion)
OTP3 (Accepted in any order within same key insertion)
Key removed

Key Inserted the second time
OTP4 (Once OTP4 is used - then any of the OTP 1 though 3 are detected as replay attacks)
Key removed

Key Inserted the third time
OTP5 (Once OTP5 is used - then any of the OTP 1 through 4 are detected as replay attacks)
Key removed

A fix has been identified and is currently being tested. More info to come after testing is complete.

Kurt L. Yubico Support.

Statistics: Posted by Kurt — Sat Feb 07, 2009 9:14 am

Re: Reusing OTP passwords

2009-02-07T09:00:21+01:00

ryan wrote:

Any word on this issue? Do you guys have a formal test/QA process? Do you run the latest opensourced version of the server?

.........

I understand that Yubico is a startup, but these are the questions my management will be asking me and I need to be able to justify our use of yubikeys.

Thanks
Ryan

Guys, be patient! This is the nature of open source and start-ups. Especially in Yubico everyone is working part-time (I met them in the Identity conference). Staff seems to be in India as I just found (http://www.networkmarvels.com/contact.html).

Everyone is doing their best with their part-time effort. But just like MySQL, it takes time to mature.

Good job

Statistics: Posted by JohnK — Sat Feb 07, 2009 9:00 am

Re: Reusing OTP passwords

2009-02-07T07:27:51+01:00

By my calculations, it was the middle of the night in Sweden when JakobE posted his message in this thread. I'd be very surprised if we don't see a prompt response.

Dick

Statistics: Posted by Dick — Sat Feb 07, 2009 7:27 am

Re: Reusing OTP passwords

2009-02-07T06:41:49+01:00

Any word on this issue? Do you guys have a formal test/QA process? Do you run the latest opensourced version of the server?

The company I work for is trying to find good solutions for 2 factor authentication and I recommended we try Yubikeys. We will run our own authentication server, but it is still important to us that Yubico act responsibly and securely. It would be a shame to ask our customers to use Yubikeys only to see Yubico have major issues or go out of business. I understand the occasional bug, but this is fairly significant issue and it does not seem to be high-priority.

I understand that Yubico is a startup, but these are the questions my management will be asking me and I need to be able to justify our use of yubikeys.

Thanks
Ryan

Statistics: Posted by ryan — Sat Feb 07, 2009 6:41 am