Yubico Forum

Hi, first time post and first time using Truecrypt 6.2a and YubiKey on a desktop running Windows XP SP3.

I formatted a Yubikey (version 2) for a static password and used it to create a password for encryption of a system partition. TrueCrypt accepts the key I put in with the YubiKey, I then create the Rescue disk and then go to the test phase. When the system reboots and asks for the password I insert the YubiKey and press the green circle. The YubiKey sends the password and true crypt does nothing. I hit enter and it says invalid password.

I have tried to make a static password with the YubiKey with the following formats all fail. Now TrueCrypt will accept the password when going through the process of setting up for an encrypted system partition but then upon the last step - test will not accept static password generated by the YubiKey .

YubiKey static password formats I have tried:
32 characters and 64 characters, using upper case and lower case characters.
Putting an enter cmd at the end of the password and not putting an enter cmd at the end of the password.

I believe I have followed the video found at the Yubico web site wiki - http://wiki.yubico.com/wiki/index.php/A ... :TrueCrypt

I did a search both here and at the TryeCrypt web forum and can not figure this out, any help would be greatly appreciated.

We would appreciate if you can provide us following more information about the problem you are facing:

1) Is the YubiKey not generating the static password at the pre-boot environment?
2) Are you able to successfully reprogram the YubiKey for the static password mode?
3) Are you setting the TrueCrypt password as the static password generated from the YubiKey?
4) Does manually entering the static password emitted from YubiKey allows you to login to the system?

The answers to the above questions will help us debugging the problem you are facing.

1) Yes it is generating the static password. TrueCrypt is not accepting it.

2) I thought I was. I would test after reprogramming by generating the password from the YubiKey in a text file, checking to see that the same password was generated repeatedly. This was happening. Unfortunately I didn't know that once you unplugged the YubiKey and plugged it back it, it generates a different password until you unplug it again. So that was my problem. The static password would change every time I unplugged the YubiKey and reinserted it.

3) Yes. But as I explained in #2 the password changed every time I unplugged YubiKey and reinserted it.

4) No.

It is working now. I have the drive encrypted with TrueCrypt and the YubiKey grants access. What I did was not follow the manual and the video and simply reprogrammed the YubiKey for a OTP instead of a static password and it works fine now.

I'm guessing that I was missing a step or doing something wrong when reprogramming for a static password. I still don't know what I did wrong. But it works as a OTP

That's strange.... the OTP should fail. Truecrypt needs a static password since it has no server to validate against (whether it be Yubico's server, or one you have set up yourself), and the password on the encrypted volume should never change, unless you manually change it. Have I been reading this thread right?

This is my first experience with Yubico's YubiKey. All I know is what I related in this thread. Its working now and it would not work in static mode. Now when I press the key on the YubiKey it sends the same password to TrueCrypt every time.

Now I'm sure I did a step wrong or missed something when I reprogrammed the YubiKey. A new step by step video for the version 2 YubiKey might help, I don't know.

... But by definition, that is a static password. Are you sure the static password radio button wasn't pressed when you configured the key?

As for documentation on the Yubikey 2, I'm not sure a video exists, but there should be written documentation all over the forum.

Yes and that only adds to my confusion as well.

Using the YubiKey configuration utility, Under the "Programming the YubiKey" I selected the first option:

Create a dynamic YubiKey configuration (OTPmode) and went on from there.

That's very strange... we could be here pondering that one for awhile. Good that it's at least working for you though!

Have you tried to slow down the OTP output rate ? Maybe the TrueCrypt input routine is a bit slow in polling the keyboard input buffer...

In the "Output parameters" panel of the configuration tool, check both the "Slow down character output..." boxes. This will throttle the output a bit.

Please let me know if this makes a difference.

Regards,

JakobE
Hardware- and firmware guy @ Yubico

I bought two Yubikeys one to use as it came, for example logging into the forum. The other to test and learn with. It took days of messing with the one I'm using on a test computer to work with True Crypt. I will try what you ask when I have time to work with it again. Thanks for the input.