Yubico Forum

On the YubiKey NEO or NEO-N, there should be no issue with all 3 modes - let us know if that is not the case in all situations, as this is a new implementation with U2F thrown in the mix.

That being said, while we don't expect any issues with all 3 modes on new U2F browser clients, we only can test against what's been released as public; Again, don't hesitate to let us know if there are any issues observed using your YubiKey in any configuration.

Thanks!

_________________
-David Maples
Yubico Senior Solutions Engineer
http://www.Yubico.com

For those who may not be familiar with the various personalization tools and the modes you can configure, here is what you need to do to manually enable all 3:


Download the personalization command line tool from here: https://developers.yubico.com/yubikey-personalization/Releases/

Extract the files and then run the ykpersonalize tool like so:
ykpersonalize -m6

Mode 6 is the OTP+U2F+CCID mode (and isn't listed in -help, which means if you aren't on a linux machine you don't have access to the manpage and have to go searching through source code to find the applicable mode)

You can now use your Yubico NEO (purchased starting in Oct 2014) with both LastPass in OTP mode and with Google U2F. I've just tested this and it works like a charm.

I've noticed weird issues with the YubiOATH client on both Windows and OSX not detecting the Yubikey once it has been set to mode 6, so if you do depend on using the YubiOATH client, you'll need to either set it to mode 1 (CCID only) or 2 (OTP + CCID). I've reported this as a bug on github: https://github.com/Yubico/yubioath-desktop/issues/14

Genius!! Agreed, this does work like a charm. Only thing I needed to do was once I'd change the mode was to reinsert the key so that Windows reinstalled the appropriate drivers. It then worked perfectly with OTP, LastPass and U2F, Google.
Thanks for this!!

I am experiencing some issues running Linux (Ubuntu 14.04 trusty).




First I set my Yubikey NEO N to mode 6 (OTP+CCID+U2F). It still emits OTP and static password as configured but I had following issues:

• YK not recognized by the Yubico Authenticator:
  
  Code:
  'NoneType' object has no attribute '_cmd_ok'
  No smartcard reader found with YubiOath applet
  
  
  The YubiOATH Android app is working just fine.
  
  This might be an issue related to what @spectralblu experienced. A comment in the bug he reported suggests that it might be due to a libccid version <1.4.18.
  
  
• U2F does not work either with the Yubico demopage or Google Accounts as normal user (running Chrome 39.0.2171.27 beta (64-bit)):
  
  Code:
   Traceback (most recent call last):
    File "/root/python-u2flib-server-demo/examples/yubiauth_server.py", line 130, in __call__
      raise Exception("FIDO Client error: %s" % error)
  Exception: FIDO Client error: 5 (TIMEOUT)
  
  I was able to perform registration and authentication while running Chrome beta as root.
  
  
• It is not possible to access the yubikey via ykpersonalize as normal user.
  
  Code:
  user@machine:~$ ykpersonalize -m2
  USB error: Access denied (insufficient permissions)
  
  
  It does however work as root.

After that I tried Mode 3 (U2F only) and had following issues:

• The Yubikey was not recognized at all by ykpersonalize
  
  Code:
  Yubikey core error: no yubikey present
  
  I had to boot into Windows and use the Yubikey Neo Manager to get it recognized again.
  
  
  
• U2F Authentication is not working unless running Chrome as root as described above.

Conclusion

It seems like there are some USB security permissions preventing the YK to work properly under Ubuntu when enabling U2F mode.

David,

I can't test the new modes right now - but let me ask you this: will it be possible (once compatibility issues are resolved) to have U2F, OTP and CCID at the same time, with touch eject enabled too? I have not seen any mention regarding touch eject in the documentation referring to the new U2F mode and NEO, such as this PDF:

https://www.yubico.com/wp-content/uploa ... ey-NEO.pdf

Touch eject is pretty important for the way I want to use the NEO - as an OTP generator for some services, and as a smartcard for other services. Without touch eject it's pretty cumbersome to use in this scenario. Having all 3 modes enabled with touch eject would be fantastic. We could give NEO tokens to everyone in the company and use them to authenticate pretty much any service.

_________________
Florin Andrei
http://florin.myip.org/

For Linux workign on root only, you need to dump this:
https://github.com/Yubico/libu2f-host/b ... -u2f.rules

into this file:
/etc/udev/rules.d/

We are planning to make this automatic with Yubikey NEO manager, in future releases of our software.

Please install latest libraries and software from our PPA
https://launchpad.net/~yubico/+archive/ubuntu/stable



The Yubikey is in MODE 3 U2F only, that is why you get that error. If you want to use the Yubikey with the personalization tool, Switch to HID mode

Please read documentation about the different supported modes:
HID, CCID, and U2F interface

_________________
-Tom

Thank you for your reply and please excuse the other thread I opened...



[s]Unfortunaley this did not solve the issue.[/s]

Edit: It works now in Mode 3. It does not work with HID+CCID+U2F (using chrome beta 39.0xx)



[s]Got the latest libraries installed from ppa.[/s]

Edit: My bad. I overlooked a library.



If I can't access the yubikey there is no way to switch modes. Please note that I am not talking about the graphical personalization tool or Yubikey NEO Manager but the ykpersonalize command line tool.
In order to switch modes I have to boot into Windows and use the Yubikey NEO Manager to do so.

To make the udev rules in the github repo work I had to make a small change, modify product id in the rule to "0116". The yubikey product id in the OTP+U2F+CCID mode is "0116" not "116". (ATTRS{idProduct}=="0116").
Now it works ok in Chrome (v39) as u2f, ccid, yubiauth-applet, OTP.

Note: I also have to create plugdev group and add my user to it, as my distro does not have the plugdev group.

I switched to 3way and changed to chrome 39 beta my win7 pro laptop. I can use the demo site to confirm u2f is working fine.

But it seems Password Safe doesn't react well to the neo being in "all 3" mode. it doesn't "see" the neo when it's plugged in. When i go to enter a "safe combination" The "yubikey" button stays grayed out so i can't press the button on the yubikey for a otp.