Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 2:05 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 4 posts ] 
Author Message
 Post subject: Windows PIV logon
PostPosted: Tue Oct 31, 2017 6:00 pm 
Offline

Joined: Tue Oct 31, 2017 5:51 pm
Posts: 2
Hello,

I have a few questions about the security of a PIV enabled Yubikey.

Since I can see, and export the certificate stored on a Yubikey, what happens if someone exports the cert, and imports it onto a different Yubikey, or other smartcard device?

Thanks


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

 Post subject: Re: Windows PIV logon
PostPosted: Tue Oct 31, 2017 7:36 pm 
Offline

Joined: Tue Feb 02, 2016 9:23 pm
Posts: 58
the cert alone wont help.

the cert is essentially just the public key along with some extra data, which the computer uses to trust this key.

on authentication the smartcard shows its certificate which tells the computer that this is a valid cert for that specific user (or not) and when it is a valid cert, the user gets prompted to enter their PIN, and that for one specific reason:

A signature upon a challenge with the private key for that public key.

trying to remove a bit of digital speech of this, the computer gives the yubi a document which says "yes I want to sign in this user." (and some extra stuff).
and the key will now sign this document.

when the signed document comes back to the computer it will check that the document hasnt been altered and the signature fits the public key from that certificate.

if everything is okay (the certificate fits the user, the computer trust whoever signed that certificate, the signature of the challenge is okay and so on) AND ONLY THEN, the user will be signed in.

--------------------------------

so to shorten this:

no, the certificate alone wont be enough.

you need the private key itself (which you certainly cannot get out of the yubi, so if you have a backup keep it safe, if the key was made on the Yubi itself, the key cannot be extracted from anywhere (BUT: there are weak key generators in some keys)

or the ability to sign anything with the private key, which requires your PIN. and with at least 4 digits on older and 6 digits on newer keys and only 3 tries before the thing locks down, an attacker wont be able to do anything quickly.


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows PIV logon
PostPosted: Tue Oct 31, 2017 10:30 pm 
Offline

Joined: Tue Oct 31, 2017 5:51 pm
Posts: 2
Very nice reply, that helps a lot.

I am still learning about PKI.

Thank you very much.


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows PIV logon
PostPosted: Wed Nov 01, 2017 12:15 am 
Offline

Joined: Tue Feb 02, 2016 9:23 pm
Posts: 58
No problem, nice to be able to help.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group