Quoting from the
YubiKey manual:
Quote:
Random Number generator
The standard YubiKey has a built-in random number generator that involves a Linear Feedback Shift Register (LFSR) that is fed from analog output of the touch sensor as well as asynchronous data from USB traffic. Although not directly critical to the security of the YubiKey or the OTP generation algorithm, the random number generation yields reasonably high quality numbers given these unrelated sources.
The YubiKey NEO features a high-quality, cryptographically secure random number generator.
What "high-quality, cryptographically secure random number generator" implementation is used in the YubiKey NEO? Has this RNG code been audited by a third-party? Random number generation is, in fact, a really critical part of cryptography, and since I'm using my NEOs in PIV and PGP modes, secure generation of RSA public/private keypairs is largely dependent on the RNG code used by the NEO.
Can Yubico comment on these concerns? Has there been an audit?
Login
FAQ
Search
