Yubico Forum

We recently received a question over email where a customer was asking whether he can make a complete copy/backup of a YubiKey to another YubiKey so that he has another YubiKey ready if my primary YubiKey is lost/broken?

The answer is...

If you are using the YubiKey in the static password mode, it is possible to reprogram a second YubiKey to emit the exact same static password (which is emitted from the first YubiKey) by reprogramming the second YubiKey with the exact same parameters (i.e. same Public ID, Private ID and AES Key) that were used for reprogramming of the first YubiKey.

If you are using the YubiKey in OTP mode, it is not possible to create a backup YubiKey emitting the same set of OTPs that of first one.

However, most of the applications supporting YubiKey OTP based authentication allow users to assign a backup YubiKey (emitting different OTPs than the primary YubiKey) to their accounts so that they can still log-in in case their primary YubiKey is lost/damaged.

We hope this helps!

Yubico should promote the use of a spare YubiKey in all software or via the authentication server.
That way, if you lose one, you don't have to login with a plain password to reset/change your key too.
Also, 2-factor authentication should have different passwords for multiple access-levels; e.g. for actions like: view, add, modify.

I've programmed a Yubikey with a static password but didn't note the original parameters used to create the password.

Can you tell me how I can derive the original parameters so that I can create a backup Yubikey w/ static password?

You can program your password using the scancode method, in the static-password tab of the personalization tool.

_________________
-Tom