Yubico Forum

YubiHSM • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

YubiHSM • Re: Microsoft Windows Login using Cloud Account

2018-01-18T17:47:27+01:00

No, per the documentation. Microsoft accounts not supported - we don't control the 2FA methods allowed by Microsoft on Cloud accounts.

Statistics: Posted by ChrisHalos — Thu Jan 18, 2018 5:47 pm

YubiHSM • Microsoft Windows Login using Cloud Account

2018-01-18T16:02:26+01:00

I have a Windows 10 device using my Microsoft Cloud credentials to login to my Windows 10 device.

The YubiKey documentation for Windows clearly states to use a local account. Is there away to use the YubiKey with my Microsoft Cloud account, thereby not having to re-set my Windows 10 device?

Statistics: Posted by EMMJunkie — Thu Jan 18, 2018 4:02 pm

YubiHSM • Cannot verify pin using libykpiv-1.dll with ykPIV_verify

2017-02-15T19:46:41+01:00

I am working to develop a limited pin change and pin reset tool that we can distribute organization wide. We only want to allow them to change their pin or reset it. If anyone knows where documentation on this dll, or the libyubikey-0.dll I would really appreciate a link to it.

I have completed the reset process using references to libykpiv-1.dll. I cannot get the ykPIV_verify to work properly. I believe the byte that I am passing containing the current pin is not formatted correctly. I am using the following code:

public bool VerifyPin(string CurrPin, out int triesLeft)
{
try
{
byte[] bytePin = Encoding.ASCII.GetBytes(CurrPin);
triesLeft = 0;
YubicoPivReturnCode code = SafeNativeMethods.YkPivVerifyPin(_state, bytePin, ref triesLeft);
if (code != YubicoPivReturnCode.YKPIV_OK)
{
return false;
}
return true;
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
triesLeft = 0;
return false;
}

}

Can anyone help me out with this?

Statistics: Posted by mcdown75 — Wed Feb 15, 2017 7:46 pm

YubiHSM • Re: Error changing the PIN: Not enough space

2016-11-01T08:43:01+01:00

To update this: I don't know what was causing this issue, but it might have been GPG for Win *or* a poor contact in the USB port.

Later I rebooted the system and tried with Yubikey plugged into another port, and it worked.

I haven't performed further troubleshooting.

Statistics: Posted by plaintexter — Tue Nov 01, 2016 8:43 am

YubiHSM • Error changing the PIN: Not enough space

2016-10-22T18:11:48+01:00

This is a new Nano with latest f/w.
I locked myself out from Admin PIN so I reset the card running one of those reset scripts (http://forum.yubico.com/viewtopic.php?f=35&t=2193#p8245) and then tried to change User PIN first.
In order to avoid setting a PIN that I won't remember tomorrow I chose the same PIN as the default (123456), but I get this error.

Code:

C:\Program Files (x86)\GNU\GnuPG>gpg2.exe --card-edit

Application ID ...: ===============================
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 04974752
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

gpg/card> admin
Admin commands are allowed

gpg/card> passwd
gpg: OpenPGP card no. ======================= detected

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 1
Error changing the PIN: Not enough space

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? q

gpg/card> quit

I tried to run the same admin > passwd process for Admin PIN - same issue, not enough space.

I did manage to change Reset PIN (by mistake, I thought I pressed 3, but I pressed 4) using the default Admin PIN, which seems to indicate the PINs were reset to default values.

Then I reinserted the card and tried again. Now GPG doesn't even wait until I try to change PIN - as soon as I pick 1 or 3, it tells me there's no space. What space? On the card? On my HDD?

Code:

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 3
Error changing the PIN: Not enough space

Statistics: Posted by plaintexter — Sat Oct 22, 2016 6:11 pm

YubiHSM • Re: RSA key store

2016-06-14T23:27:17+01:00

Would be interested in a HSM that supported RSA sign function with a flexible PIN policy that includes no PIN as an option.

Scenario would be automated code signing to protect the private key.

Statistics: Posted by offset — Tue Jun 14, 2016 11:27 pm

YubiHSM • Re: YubiHSM/PyHSM getting started question.....

2016-03-24T08:47:20+01:00

Thank you for the reply - will try shortly!

Dom

Statistics: Posted by domf — Thu Mar 24, 2016 8:47 am

YubiHSM • Re: YubiHSM/PyHSM getting started question.....

2016-03-24T08:37:52+01:00

Hey,

What you're missing is that you need to hex decode the password before you pass it to the unlock function. See https://github.com/Yubico/python-pyhsm/ ... unlock#L76 for an example of how this is done in the yhsm-keystore-unlock utility.

/klas

Statistics: Posted by Klas — Thu Mar 24, 2016 8:37 am

YubiHSM • YubiHSM/PyHSM getting started question.....

2016-03-23T16:11:25+01:00

I am looking at the possibility of using YubiHSM to encrypt data on a server without having the ability for the same server to decrypt it - however I am having trouble getting past go with the python API.

I can connect to the HSM OK, generate keys and unlock them with no issues through a terminal. However when I attempt to unlock the keys using pyhsm I am told the master key which I use successfully through the terminal is too long.

Screen Shot 2016-03-23 at 15.07.47.png

I feel like I am missing something obvious....

Dom

Statistics: Posted by domf — Wed Mar 23, 2016 4:11 pm

YubiHSM • [HELP] - YubiKey not working in Windows (Multiple Version)

2015-10-08T08:23:19+01:00

We have 4 options here, try them in order

(1) Uninstall ALL entries in Device Manager for the NEO.

*If you have U2F enabled, you should see Human Interface Devices > HID-compliant device.
*If you have OTP enabled, you should see Keyboards > HID Keyboard Device.
*If you have CCID enabled, you should see Smart card readers > Microsoft Usbccid Smartcard Reader (WUDF), and Smart cards > Identity Device (NIST SP 800-73 [PIV]).

After all are removed, either "Scan new hardware" or remove the NEO and re-insert.

(2) Uninstall all entries under Universal Serial Bus controllers, and then restart. These will typically be reloaded when you restart.

(3) Use the Intel Driver Update Utility (assuming you are Intel-based), and restart after all drivers are updated. Alternatively, you can download the USB and Chipset drivers from your manufacturer's support website and install.

(4) On Windows 10 if on build 10.0.10240 updating to Windows 10 1511 build 10.0.10586 corrected the issue. You can simply open a cmd prompt and view the system build number at top.

(5) Re-install Windows.

WINDOWS 10
Win 10 - YK4.PNG

NEO
1.PNG

EDGE
2.PNG

Statistics: Posted by Tom2 — Thu Oct 08, 2015 8:23 am

YubiHSM • Re: YubiHSM stuck in config mode

2015-07-27T14:34:15+01:00

Tom2 wrote:

Does the LED switch to a faster pace (4 Hz) ? This signals "waiting
for more input", which is yielded in HSM mode.

The flashing frequency doesn't change at all. I can't tell for sure what frequency it's flashing at, that's just something I'm bad at. The manual doesn't say anything about 0.5Hz, 1Hz, or 4Hz; the closest frequencies mentioned in the manual are 0.4Hz, 0.8Hz, and 3Hz. From watching the clock on my desktop and watching the blinking, I think it's blinking at 1.6Hz, which according to the manual corresponds to "in config mode, waiting for user input". Like I mentioned.

Tom2 wrote:

Forcing configuration mode at insert may be a bit less intuitive with the new form factor. You need to hold it for 3 seconds and then release. Did you do this?

I realize I wasn't explicit about the number of seconds spent touching the HSM, but I did mention that I tried entering configuration mode according to the manual's directions.

jgoguen wrote:

I've tried putting it in the same and a different USB port while continuing to hold the touch area (which is how the manual says to enter configuration mode).

I've tried for 3 seconds exactly (as near as I can tell watching my desktop clock) and clearly more than 3 seconds. I've also tried putting it in, waiting a second, then touching it. The LED continues blinking at the same frequency.

Statistics: Posted by jgoguen — Mon Jul 27, 2015 2:34 pm

YubiHSM • Re: YubiHSM stuck in config mode

2015-07-27T09:39:17+01:00

There are two modes of flashing on the HSM - the faster 1Hz flashing
for HSM mode and the slower 0.5 Hz for configuration mode.

test if the device is in HSM mode.

1. Close all instances of programs/terminal emulators
2. Insert the device
3. Fire up a terminal emulator
4. Type a key a couple of times

Does the LED switch to a faster pace (4 Hz) ? This signals "waiting
for more input", which is yielded in HSM mode.

Forcing configuration mode at insert may be a bit less intuitive with
the new form factor. You need to hold it for 3 seconds and then
release. Did you do this?

Let me know.

Statistics: Posted by Tom2 — Mon Jul 27, 2015 9:39 am

YubiHSM • Re: YubiHSM stuck in config mode

2015-07-23T15:58:06+01:00

Tom2 wrote:

which version of HSM is this?

YubiHSM 1.5.3. My apologies, I said I set up a new HSM, I didn't realize you could get any other version as a new HSM.

Tom2 wrote:

Did you read the manual

Yes. A few times.

Tom2 wrote:

there is a section reporting blinking HZ which status does your blinking corresponds to?

jgoguen wrote:

now it's stuck blinking what I think is the "in config mode, waiting for user input" state

Tom2 wrote:

Can you ZAP the configuration and restart?

No.

jgoguen wrote:

I can't connect to the HSM at all

Tom2 wrote:

Are you removing the HSM and re-insert it while holding the button pressed?

What button? The user manual doesn't mention a button. I've tried taking it out and putting it back in the same and a different USB port, and I've tried putting it in the same and a different USB port while continuing to hold the touch area (which is how the manual says to enter configuration mode).

Statistics: Posted by jgoguen — Thu Jul 23, 2015 3:58 pm

YubiHSM • Re: YubiHSM stuck in config mode

2015-07-23T10:27:18+01:00

please provide more details.

which version of HSM is this?
Did you read the manual, there is a section reporting blinking HZ which status does your blinking corresponds to?

Can you ZAP the configuration and restart?

Are you removing the HSM and re-insert it while holding the button pressed?

Statistics: Posted by Tom2 — Thu Jul 23, 2015 10:27 am