Yubico Forum

I have seen a video recently of some higher up person in Yubico, who had something to do with the government or something and as part of his talk, he said there is a special acid wash that could strip away the resin. Which leads me to ask the question that how secure are the secrets really if someone can gain access to the raw guts of the Yubikey? Are the chips, themselves, protected from giving up their secrets against someone who has successfully removed all the resin and have the exposed components etc?

_________________
My GnuPG (PGP) Key ID: 614D98E6

The old yubikeys are suspecible to this attack. (I don't remember when Yubico started using security elements, I however know that yubikeys that look like this:

Isnt fully secure)

But the new yubikeys (all Yubikey Neo, Yubikey 4) are constructed out of a real security element like the one used in bank cards, thus any physical attacks, including acid, electron microscope etc are impossible. They are even in the process getting FIPS 140-2 level 3 certification, which is a gurantee that its impossible to attack

So you can, in an organization, safely program all yubikeys with the same company-secret AES and then identify user based on private ID.

Hackers have done tons of things with bank cards though.

_________________
My GnuPG (PGP) Key ID: 614D98E6

What do you mean by company secret and identify them? By what means?

_________________
My GnuPG (PGP) Key ID: 614D98E6

What I mean, is that its safe to program the very same AES key, into X yubikeys used in a specific corporation, and then use the "Private ID" field, to identify who is logging on.
Thus you can turn the "public identity" field off, which means you will get a string of exactly 32 characters when pressing the button.

You may find this link interesting. They dissolved all the resin with Acetone: http://www.hexview.com/~scl/neo/

In this state, how secure is the Yubikey? If the resin is providing the security of the secrets, that would be worrying. So how capable is the technology it's self, at never divulging the private key / secrets that are programmed into the Yubikey when physical access of the internals is very possible?

_________________
My GnuPG (PGP) Key ID: 614D98E6

Then you have misunderstand everything.
The first yubikey, and the second one - both who looks similiar to the picture I posted - are suspectible to this attack you linked to. (The second yubikey looks like a NEO but lacks a logo in the touch button)

The NEO and 4 however, is impossible to extract the secrets out of. To understand why it isn't a issue that the casing can be dissolved with acetone, its because its not part of what is called the "Security Boundary".

The main MCU (NXP LPC11xx or LPC13xx) isn't security sensitive, as it only acts as an interface between the USB and the A7005.
Think the main MCU as the USB-connected Smart-card reader. And the A7005 as your actual smart-card.

The security boundary is however the casing of the A7005 chip. The A7005 chip is EAL5+ certified, which means its impossible to physically attack the A7005 chip for it to give up its secrets. Yubico is in the process of getting FIPS 140-2 level 3 certification - which is the HIGHEST POSSIBLE for a battery-less device.
(level 4 REQUIRES a battery)

All secrets, including U2F, Yubico-OTP, CCID/PIV etc, is stored inside the A7005 chip.

Very nice. Thanks.

_________________
My GnuPG (PGP) Key ID: 614D98E6

Hi, I cant see Yubico listed in the 'modules in processing' list. Does anyone have any links? Thanks.