Joined: Tue May 13, 2008 12:24 am
Posts: 49
|
|
Q: Is there a way to associate users with their YubiKey? Would it be dangerous to have the device ID printed on the key?
A: Printing the public ID on the device won't hurt and as it is sent as a part of the authentication string (if configured to do so) it is known anyway. The private id is not known and should definitely be kept secret. The basic steps to verify a received authentication string is as follows:
1. Use public ID to get the appropriate AES key
2. Decrypt the OTP
3. Verify the CRC
4. Check the private ID
5. Check the counter and timer fields
|
|
Login
FAQ
Search
