Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 4:11 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 1 post ] 
Author Message
PostPosted: Sun Feb 22, 2015 3:51 am 
Offline

Joined: Tue Nov 18, 2014 9:14 pm
Posts: 95
Location: San Jose, CA
I've been doing a lot of thinking about the security of my Yubikey against NFC denial of service attacks(which is completely insecure against), and I think I've got some changes that would significantly mitigate any damage that an unknown attacker could achieve via NFC.

These changes seem like they would be easy-to-implement and would contribute greatly to my own peace of mind, without preventing people from doing what they've already been doing if they don't care about this kind of attack:

PIV Applet

Add the ability to configure the Yubikey NEO PIV applet (using a command which requires the management key) to behave according to SP 800-73-3 with respect to NFC. As in, I'd like to be able to configure the applet to only allow the retrieval of the CHUID, Discovery object, and the cert for key 9E, as well as only allow signing for key 9E, when accessed via NFC. All operations that would require a PIN wouldn't be allowed over NFC, and any attempt to even authenticate with a PIN wouldn't be allowed either(preventing the pin retry count from being exhausted). This prevents someone from locking me out of the PIV app via NFC.

OpenPGP Applet

Add the optional ability to configure the Yubikey OpenPGP app to disallow access via NFC.

OATH Applet

Prevent the app from accepting a command to reset the app over NFC unless the reset command is authenticated. (The reset command can still be sent unauthenticated via USB)

NDEF Applet

Allow the user to disable the NDEF applet.


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group