Yubico Forum

We often get the question regarding retrieval of AES keys where customers who have bought Yubikeys later ask for their AES key. As a part of a general security review, we changed the server setup in March 2009 and moved the key storage to a separate machine. The new setup does not allow for keys to be extracted.

Customers who have purchased a few keys and want to use them with our validation service therefore have to re-configure their keys and use our AES upload feature.

Customers with larger deployments who want their secrets MUST request the secrets AT THE TIME OF PURCHASE and further tell if the keys are to be used in a private context or with the Yubico validation server.

We can then provide the key secrets on CD together with the order or sent by e-mail, encrypted with a customer supplied GPG key. CD deliveries can be plain text, GPG symmetrically encrypted with passphrase in e-mail or GPG encrypted with customer's public key. Due to the administrative overhead, we have a minimum order quantity of 100 Yubikeys in a single order for this option. And just to have it said again - we need to know the provisioning options at the time of ordering.

The default key provisioning format is a semicolon-separated Ascii file

barcode-id ; public-id-modhex ; public-id-hex ; private-id-hex ; aes-key-hex

A Sample file looks like:

00077404;cccccccbdugr;000000012e5c;9f441fa05922;69fc80be0e757941013c35b70b517d8d
00077405;cccccccbdugt;000000012e5d;e0e21cfd110b;36448e5e4501492b031fe85704d933a1
00077406;cccccccbdugu;000000012e5e;9b90c435482e;65b43e02586ede3bb361b71dcb8889b4
00077407;cccccccbdugv;000000012e5f;3bb64901c5c8;1dcd9f5c9bc57570405db657b28d4f03
00077408;cccccccbduhc;000000012e60;3107b6c27658;280d735e327384708190d5216861f289
00077409;cccccccbduhb;000000012e61;94fe38ba9b16;aac0525ed2682be2c5376cba70e39f32


We have a discounted end-of-the-year special available on the web-store for 100 and 500 units. Take the opportunity to order Yubikeys with secrets delivered in the format of choice.

With the best regards,

JakobE
Hardware- and firmware guy @ Yubico