Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 10:07 am

All times are UTC + 1 hour




Post new topic Reply to topic  [ 9 posts ] 
Author Message
PostPosted: Fri Sep 29, 2017 3:06 pm 
Offline
User avatar

Joined: Sun Jul 24, 2011 12:48 am
Posts: 37
I have seen a video recently of some higher up person in Yubico, who had something to do with the government or something and as part of his talk, he said there is a special acid wash that could strip away the resin. Which leads me to ask the question that how secure are the secrets really if someone can gain access to the raw guts of the Yubikey? Are the chips, themselves, protected from giving up their secrets against someone who has successfully removed all the resin and have the exposed components etc?

_________________
My GnuPG (PGP) Key ID: 614D98E6


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Fri Sep 29, 2017 8:25 pm 
Offline

Joined: Thu Sep 28, 2017 1:03 pm
Posts: 6
The old yubikeys are suspecible to this attack. (I don't remember when Yubico started using security elements, I however know that yubikeys that look like this:
Image
Isnt fully secure)

But the new yubikeys (all Yubikey Neo, Yubikey 4) are constructed out of a real security element like the one used in bank cards, thus any physical attacks, including acid, electron microscope etc are impossible. They are even in the process getting FIPS 140-2 level 3 certification, which is a gurantee that its impossible to attack

So you can, in an organization, safely program all yubikeys with the same company-secret AES and then identify user based on private ID.


Top
 Profile  
Reply with quote  
PostPosted: Fri Sep 29, 2017 9:11 pm 
Offline
User avatar

Joined: Sun Jul 24, 2011 12:48 am
Posts: 37
Hackers have done tons of things with bank cards though.

_________________
My GnuPG (PGP) Key ID: 614D98E6


Top
 Profile  
Reply with quote  
PostPosted: Fri Sep 29, 2017 10:01 pm 
Offline
User avatar

Joined: Sun Jul 24, 2011 12:48 am
Posts: 37
What do you mean by company secret and identify them? By what means?

_________________
My GnuPG (PGP) Key ID: 614D98E6


Top
 Profile  
Reply with quote  
PostPosted: Sat Sep 30, 2017 9:52 am 
Offline

Joined: Thu Sep 28, 2017 1:03 pm
Posts: 6
What I mean, is that its safe to program the very same AES key, into X yubikeys used in a specific corporation, and then use the "Private ID" field, to identify who is logging on.
Thus you can turn the "public identity" field off, which means you will get a string of exactly 32 characters when pressing the button.


Top
 Profile  
Reply with quote  
PostPosted: Sat Sep 30, 2017 8:49 pm 
Offline
User avatar

Joined: Sun Jul 24, 2011 12:48 am
Posts: 37
You may find this link interesting. They dissolved all the resin with Acetone: http://www.hexview.com/~scl/neo/

In this state, how secure is the Yubikey? If the resin is providing the security of the secrets, that would be worrying. So how capable is the technology it's self, at never divulging the private key / secrets that are programmed into the Yubikey when physical access of the internals is very possible?

_________________
My GnuPG (PGP) Key ID: 614D98E6


Top
 Profile  
Reply with quote  
PostPosted: Sun Oct 01, 2017 7:50 am 
Offline

Joined: Thu Sep 28, 2017 1:03 pm
Posts: 6
Then you have misunderstand everything.
The first yubikey, and the second one - both who looks similiar to the picture I posted - are suspectible to this attack you linked to. (The second yubikey looks like a NEO but lacks a logo in the touch button)

The NEO and 4 however, is impossible to extract the secrets out of. To understand why it isn't a issue that the casing can be dissolved with acetone, its because its not part of what is called the "Security Boundary".

The main MCU (NXP LPC11xx or LPC13xx) isn't security sensitive, as it only acts as an interface between the USB and the A7005.
Think the main MCU as the USB-connected Smart-card reader. And the A7005 as your actual smart-card.

The security boundary is however the casing of the A7005 chip. The A7005 chip is EAL5+ certified, which means its impossible to physically attack the A7005 chip for it to give up its secrets. Yubico is in the process of getting FIPS 140-2 level 3 certification - which is the HIGHEST POSSIBLE for a battery-less device.
(level 4 REQUIRES a battery)

All secrets, including U2F, Yubico-OTP, CCID/PIV etc, is stored inside the A7005 chip.


Top
 Profile  
Reply with quote  
PostPosted: Sun Oct 01, 2017 2:28 pm 
Offline
User avatar

Joined: Sun Jul 24, 2011 12:48 am
Posts: 37
Very nice. Thanks.

_________________
My GnuPG (PGP) Key ID: 614D98E6


Top
 Profile  
Reply with quote  
PostPosted: Wed Nov 29, 2017 12:32 pm 
Offline

Joined: Wed Nov 29, 2017 12:29 pm
Posts: 1
Hi, I cant see Yubico listed in the 'modules in processing' list. Does anyone have any links? Thanks.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group