Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 7:07 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 3 posts ] 
Author Message
PostPosted: Fri Jan 09, 2009 11:51 pm 
Offline

Joined: Wed Jan 07, 2009 4:15 am
Posts: 6
I've been reviewing the validation server code, and was curious what the UID (also called SecretID), 6-byte field in the decrypted OTP is intended to be used for?

The Validation Server logic does not seem to use it for validation.

Is this something that is unique to each yubikey? Should we store it in our database and use it for yet another validation test, checking to make sure the values match?

Thanks!


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Sat Jan 10, 2009 6:48 pm 
Offline
Site Admin
Site Admin

Joined: Wed May 28, 2008 7:04 pm
Posts: 263
Location: Yubico base camp in Sweden - Now in Palo Alto
The intended usage is when a collection Yubikeys share the same AES key.

Assume a case where the public id (fixed part) is set to zero bytes. The OTP is then 128 bits = 32 modhex characters. The server decrypts all keys in the collection using the same AES key and uses the private id (uid) to determine the user's id.

If not used in this context, such as how the Yubico authentication server setting works, the private id (uid) is typically set to a random string. Although not needed, the server application can verify this number.

With the best regards,

JakobE
Hardware- and firmware guy @ Yubico


Top
 Profile  
Reply with quote  
PostPosted: Mon Jan 19, 2009 12:16 am 
Offline

Joined: Wed Jan 07, 2009 4:15 am
Posts: 6
Thanks Jacob.

We've decided to use the internal UID as an extra authentication check.

Never thought to use common AES keys....probably more security risk that way, since getting your hands on the key then lets you crack multiple hardware keys, but an interesting idea nonetheless.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group