It is challenging for many reasons. If you use the OTP functionality then the shared secret would have to be stored outside the encrypted drive, which defeats the purpose. Using the challenge/response mode of the yubikey would be preferable, but the tiny truecrypt boot loader does not provide any mechanism for extensibility, especially USB device support.
These problems need to be solved for the good of the community. My company is working with Yubico to figure out how to do strong security with Truecrypt, because our product (AuthLite) would be more useful on a workstation if the drive was secure from offline attacks.
|