Yubico Forum

Announcements • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

Announcements • YubiKey Smart Card Minidriver

2017-10-27T19:03:00+01:00

YubiKey Smart Card Minidriver
The YubiKey Smart Card Minidriver allows for the use of native Windows services to enroll YubiKeys as smart cards, both directly by individual users, as well as with administrators enrolling YubiKeys as smart cards on behalf of other users. For environments with just Windows PCs, the YubiKey Smart Card Minidriver and native Windows smart card services provide the best integration of the YubiKey’s smart card functions.
Key Features:
●Use multiple authentication certificates
●Set / Change smartcard PIN via Windows GUI
●Unblock a blocked PIN
● Certificate Enrollment (add user certificate)
○ Auto-enrollment
○ MMC admin console on behalf of other users
● Set policy for touch to allow private key use
● Import certificate chains for User Certificates
● Supported Key Algorithms
○ RSA 2048-bit keys
○ Elliptic Curve Cryptography (ECC) ECDH/ECDSA-P256 keys
○ Elliptic Curve Cryptography (ECC) ECDH/ECDSA-P384 keys 

Identity Device (NIST SP 800-73 [PIV])
For environments where the YubiKey Smart Card will be used with accounts on mixed operating systems, including MacOS and Linux, the YubiKey PIV Manager should be used across all systems. The native Windows smart card services and the YubiKey PIV Manager should not be used in conjunction for managing the YubiKey smart card functions.

A PIV-compliant YubiKey NEO holds 4 distinct slots for certificates and a YubiKey 4 holds 24, as specified in the PIV standards document. Each of these slots is capable of holding an X.509 certificate, together with its accompanying private key. Technically these four slots are very similar, but they are used for different purposes.
Features:
● Use a single certificate of each type: Authentication, Signature, & Encryption (key management)
● Certificates using RSA 2048-bit keys

I loaded certificates using the PIV manager / PIV tool and upgraded to YubiKey Smart Card Minidriver and now I cannot see or use my certificates.
Answer: Due to the changes stated below, the YubiKey is now a container-based smart card in Windows. When enrolling certificates using the PIV manager or PIV Tool, it does not create the necessary container map for Windows to allow applications to access the certificates.
Resolution 1: Reset your YubiKey and follow the directions in the YubiKey Smart Card Minidriver Guides (https://www.yubico.com/support/knowledg ... mart-card/) for enrolling certificates.
Resolution 2:If you need to maintain cross-platform compliance, you can manually remove the YubiKey Smart Card Minidriver.
1.Open Device Manager, locate and right-click YubiKey Smart Card (under Smart cards) and select Uninstall Device (mark Delete the driver software for this device).
Block re-installation from Windows Update.
1.WinKey + R
2.type: gpedit.msc
3.Browse to Local Computer policy, Computer Configuration, Administrative Templates, System, Device Installation, Device Installation restrictions.
4.Double-click Prevent installation of the devices that match any of these device IDs
5.Click Enabled, Show Contents, click ADD, in the ADD item field type: YK4 SCFILTER\CID_59756269b657934. YK NEO SCFILTER\CID_59756269b657934e454f7233 OK, Click OK,
6.Exit gpedit.msc

Why can’t I use the YubiKey Smart Card Minidriver and Identity Device (NIST SP 800-73 [PIV]) side by side?
Answer: With the YubiKey Smart Card Minidriver, Microsoft Windows views a smart card as a container as each certificate is loaded onto the YubiKey; the Windows credential provider then reads the certificates and creates a container map on the YubiKey. Windows utilizes the container map to allow applications access to the certificates for their intended usage based on the certificate OID in the EKU field of the certificate.
(https://technet.microsoft.com/en-us/lib ... 59(v=ws.11).aspx) The Windows inbox Device (NIST SP 800-73 [PIV]) views and treats the YubiKey as a PIV-enabled smart card and identifies the YubiKey as a slot-based smart card.

I’ve recently updated my computer and Windows reports no certificates are present or the Key Set does not exist.
This is due to one of several issues:
●Your computer shows Identity Device (NIST SP 800-73 [PIV]) in Device Manager under Smart cards, and you still receive one of the errors. This is most likely due to your computer downloading a Security Update from Microsoft to resolve the ROCA Vulnerability with RSA Key Generation on affected TPMs and the update did not install properly. To resolve, complete one of the following options:
○Open Control Panel > Programs and Features > View Installed Updates. Locate and right-click Security update for Microsoft Windows (KB4041676) and select Uninstall.
○Open Action Center > All Settings > Update and Security > Troubleshoot > Windows Update > Run troubleshooter. When the troubleshooter completes, reboot and check for updates.
○Update to Fall Creators Update 1709 and ensure the following update has been installed: Security update for Microsoft Windows (KB4043961).
●Your computer shows YubiKey Smart Card Minidriver in Device Manager under Smart cards, you reset your YubiKey enrolled certificates via MMC, and you still receive one of the error messages. This is most likely due to your computer downloading a Security update from Microsoft to resolve the ROCA Vulnerability with RSA Key Generation on affected TPMs, and the update did not install properly. To resolve, complete one of the following options:
○Open Control Panel > Programs and Features > View Installed Updates. Locate and right-click Security update for Microsoft Windows (KB4041676) and select Uninstall.
○Open Action Center > All Settings > Update and Security > Troubleshoot > Windows Update > Run troubleshooter. When the troubleshooter completes, reboot and check for updates.
○Update to Fall Creators Update 1709 and ensure the following update has been installed: Security update for Microsoft Windows (KB4043961).
●None of the above options resolved this issue. Visit (https://www.yubico.com/support/get-support/) and open a support case. Describe your use case in as much detail as possible, and confirm you have completed all troubleshooting steps listed in this article.

Statistics: Posted by mattlegitt — Fri Oct 27, 2017 7:03 pm

Announcements • [HELP] - YubiKey not working in Windows (Multiple Version)

2015-10-08T08:23:19+01:00

We have 4 options here, try them in order

(1) Uninstall ALL entries in Device Manager for the NEO.

*If you have U2F enabled, you should see Human Interface Devices > HID-compliant device.
*If you have OTP enabled, you should see Keyboards > HID Keyboard Device.
*If you have CCID enabled, you should see Smart card readers > Microsoft Usbccid Smartcard Reader (WUDF), and Smart cards > Identity Device (NIST SP 800-73 [PIV]).

After all are removed, either "Scan new hardware" or remove the NEO and re-insert.

(2) Uninstall all entries under Universal Serial Bus controllers, and then restart. These will typically be reloaded when you restart.

(3) Use the Intel Driver Update Utility (assuming you are Intel-based), and restart after all drivers are updated. Alternatively, you can download the USB and Chipset drivers from your manufacturer's support website and install.

(4) On Windows 10 if on build 10.0.10240 updating to Windows 10 1511 build 10.0.10586 corrected the issue. You can simply open a cmd prompt and view the system build number at top.

(5) Re-install Windows.

WINDOWS 10
Win 10 - YK4.PNG

NEO
1.PNG

EDGE
2.PNG

Statistics: Posted by Tom2 — Thu Oct 08, 2015 8:23 am

Announcements • YubiKing 2015! Yubico’s Virtual Hackathon, USD $3000 prize!

2015-03-27T08:29:20+01:00

OFFICIAL PAGE: https://www.yubico.com/yubiking/

Security Experts, Developers, And Geeks:
Join YubiKing 2015
Yubico’s Virtual Hackathon For Strong, Simple Authentication

Yubico believes that everyone deserves strong, easy, and affordable authentication, and we are committed to help Internet citizens take control of their online identities. That’s why we invented the YubiKey and co-invented the FIDO Alliance’s emerging open standard called Universal 2nd Factor (U2F).

YubiKing is your opportunity to create the next innovative use for a YubiKey. Enter your project in the YubiKing Virtual Hackathon today to become eligible to win great prizes!

WHAT YOU’LL BUILD

Almost anything that involves authentication can be made easier and stronger using YubiKey. YubiKey works in dozens of applications, supporting multiple authentication protocols, including OTP, PIV, OpenPGP, and U2F. Yubico has published integration libraries, plugins and documentation which you can use to enable your YubiKey application. All YubiKey authentication protocols are welcome. Qualified contest participants will be supplied with a YubiKey.

WHAT YOU’LL WIN

The three projects our judges deem best will receive US$3000 and a suite of YubiKeys including a limited-edition commemorative YubiKing YubiKey — plus, we will feature your creation at Black Hat USA 2015 and promote it on our websites, blog, and newsletter, in a press release, and on social media.

THE SPECIFICS

Implement a unique or new solution, product, or service utilizing the YubiKey. You can submit existing products, including commercial products, as long as they were announced or made available no earlier than January 1, 2015. To win, the creation must belong to you, must be working, and must be available for the judges to assess per the official rules by June 15, 2015.
Final submissions must be accompanied by a video describing and demonstrating the project. Tag the video with #yubiking if public.
Final judging to take place June 15, 2015. Winners will be announced July 1, 2015.
See Official Rules for more details.
Questions? Contact yubiking@yubico.com or visit the Yubico Forum.
SPREAD IT AROUND!

Download, print, and post this flier at your school or organization.
https://www.yubico.com/wp-content/uploa ... e-page.pdf

YUBIKING 2015 ENTRY FORM

Submit your idea for Yubico’s YubiKing Virtual Hackathon by entering your information below. Please enter only once for each project: if you are working on a team please submit a single entry and add team info below. View full details and Official Rules here.

RESTRICTIONS:
You must be above the age of majority in the country, state, province or jurisdiction of residence (or at least twenty years old in Taiwan) at the time of entry.
The YubiKing contest is not open to residents of Italy, Brazil, Quebec, Cuba, Iran, Syria, North Korea, Sudan, or Myanmar (Burma) in accordance with legal restrictions in those countries.

REGISTRATION FORM: https://www.yubico.com/yubiking/

Statistics: Posted by Tom2 — Fri Mar 27, 2015 8:29 am

Announcements • Re: Yubikey Logon Disabled

2015-01-29T00:47:10+01:00

vBulletin is one of the good ones, but the choice of solution might (hopefully) also depend on some considerations about social media features, community features, etc. also?

If so, then the Drupal (7) CMS has a lot of tools, including a working Yubikey integration.

https://www.drupal.org/project/yubikey

The FORUM of Drupal, however, is not a proper forum solution, therefore there are other extensions like:

Integration with phpBBforum, but the development is stalled, pending some extra interest in development:
https://www.drupal.org/project/phpbbforum

vbDrupal - vBulletin integration, also stalled development pending more interest:
https://www.drupal.org/project/vbdrupal

And community solutions like:
https://www.drupal.org/project/commons
https://www.drupal.org/project/openatrium

Statistics: Posted by Nomadus — Thu Jan 29, 2015 12:47 am

Announcements • Re: Yubikey Logon Disabled

2014-11-19T12:46:18+01:00

Eventually, we are considering moving to a new forum platform, thus we will not spend engineering time on this unless we will keep using PHPBB.

We looked into NODEbb, if you guys have good ideas please share we will look into them.

Tom.

Statistics: Posted by Tom — Wed Nov 19, 2014 12:46 pm

Announcements • Re: Yubikey Logon Disabled

2014-11-18T23:01:29+01:00

Any chance U2F keys will be added as a authentication option in the near future?

Statistics: Posted by darco — Tue Nov 18, 2014 11:01 pm

Announcements • Re: Yubikey Logon Disabled

2014-10-14T08:27:47+01:00

Hello Everyone,

In an effort to allow more users to access this community we tried to disable the Yubikey with Yubico OTP required at logon on.
Unfortunately in less then 12 hours we were flooded by spam/bot brute-forcing accounts and pizza delivery pranks.

We have now re-enabled Yubikey at logon and hopefully removed all the spam/fake users. We apologize for the inconvenience.

However, if a user without a Yubikey would like to join i can manually subscribe him for now. ( this is limited to my free time and the number of requests i will receive)
Remember that you can still disable Yubikey at logon in the user control panel options (not recommended)

We are looking in deploying a more modern forum community in 2015.

All users registered after 4:43 UTC +0 of the 13th of October 2014, will have to register again.

Best Regards,
Tom.

Statistics: Posted by Tom — Tue Oct 14, 2014 8:27 am

Announcements • Re: Yubikey Logon Disabled

2014-10-13T16:03:04+01:00

Ok, apparently our customization was so strict that phpBB disable mod wasnt happy with that.
Now it should be fixed i have registered a user without Yubikey.

If you guys test it out would be great!

To answer your question: We will re-enable the Yubikey logon probably and we do want people to login without Yubikeys in order to prevent spam, hijaking, etc etc
The reason why we temporally disabled this is for upcoming news which may lead to lot of support requests. For the future, users will have to get a Yubikey.

So yes, if they dont get a Yubikey they will be locked out of the forum again.

We understand that this could be frustrating for some, however it makes our community spam/hack free.

Thanks again for the feedback!

Statistics: Posted by Tom — Mon Oct 13, 2014 4:03 pm

Announcements • Re: Yubikey Logon Disabled

2014-10-13T15:52:34+01:00

I think you mean 2014/10/13, even the Americans are not crazy enough to reverse the month and day when following the year!

I just checked the register page, and I still see the YubiKey OTP field as required. Clemens reports that it is also required, and leaving it blank or entering garbage are not possible.

Question: Will accounts created during the next 2-3 weeks be able to login again once the YubiKey login is re-enabled? It would be a shame if not. If they are able to post, I guess that would make the YubiKey logon permanently optional on the forum...

Statistics: Posted by chmac — Mon Oct 13, 2014 3:52 pm

Announcements • Yubikey Logon Disabled

2014-10-13T09:17:31+01:00

Hello,

Since 2014/10/13 the forum.yubico.com has disabled the Yubikey support for log-on. This is to allow non-Yubikey user to be able to access our forum in the upcoming weeks to discuss latest news and features.

We will re-enable this feature, without warning, if subject of spam or after the news hits the peak of the curve.

Best Regards,
Tommaso.

Statistics: Posted by Tom — Mon Oct 13, 2014 9:17 am

Announcements • Yubico Authenticator

2014-02-19T13:51:41+01:00

Today we released a first version of the Yubico Authenticator Desktop.

Please download it and report any bugs on GitHub.
No OSX package available yet, you will need to run it from source ( user@home$ python ui_systray.py )

Windows:
http://www.yubico.com/applications/internet-services/

Linux and OSX:
http://opensource.yubico.com/yubioath-desktop/

Statistics: Posted by Tom — Wed Feb 19, 2014 1:51 pm

Announcements • Yubico NEO PIV-Beta Program

2013-08-28T16:01:14+01:00

We're inviting PKI experts in enterprises to apply to join our YubiKey NEO with PIV beta program which will run from September 9th, 2013 through November 1st.

As we can only support a few beta testers, to apply to participate, you will need to send piv-beta@yubico.com a brief description of the test project you are proposing. PIV compatible devices work well under Windows and PKCS#11 applications under GNU/Linux via OpenSC.

Those accepted into the program will be sent a link to purchase 1-2 production YubiKey NEO(s) pre-loaded with the beta PIV applet. We are looking for a wide range of use cases that can be used to demonstrate that YubiKey form factor for PKI can deliver excellent user experience.

Statistics: Posted by David — Wed Aug 28, 2013 4:01 pm

Announcements • [Yubi Competition] - Winner June 2013

2013-07-16T10:32:22+01:00

Share your knowledge and win a Yubikey!

We are proud to announce the winners of the Yubi Competition: Share your knowledge and win a Yubikey!

For the best Project the winner is Morphlin. Read his thread [PROJECT] Yubikey Monitor (Standalone).

Morphlin won one Yubikey NANO for the value of 40$!

Good Job !

Statistics: Posted by Tom — Tue Jul 16, 2013 10:32 am

Announcements • [Yubi Competition] - Winners March 2013

2013-04-02T14:27:32+01:00

Share your knowledge and win a Yubikey!

We are proud to announce the winners of the Yubi Competition: Share your knowledge and win a Yubikey!

We didn't have any nice How-To this month thus we decided to reward the 2 best projects presented in March 2013.

For the best Project the winners are Untouchab1e & SarahC. Read their threads [PROJECT] Yubinotes - Notes app for Android and [PROJECT] NoDatabase ASP.Net VB authentication server.

Untouchab1e and SarahC won one Yubikey NANO for the value of 40$!

Good Job !

Statistics: Posted by Tom — Tue Apr 02, 2013 2:27 pm