YubiKey

YubiKey 4 and YubiKey 4 Nano USB devices.

The YubiKey is a hardware authentication device manufactured by Yubico that supports one-time passwords, public key encryption and authentication, and the Universal 2nd Factor (U2F) protocol[1] developed by the FIDO Alliance (FIDO U2F). It allows users to securely log into their accounts by emitting one-time passwords or using a FIDO-based public/private key pair generated by the device. YubiKey also allows for storing static passwords for use at sites that do not support one-time passwords.[2] Facebook uses YubiKey for employee credentials,[3] and Google supports it for both employees and users.[4][5] Some password managers support YubiKey.[6][7]

The Yubikey implements the HMAC-based One-time Password Algorithm (HOTP) and the Time-based One-time Password Algorithm (TOTP), and identifies itself as a keyboard that delivers the one-time password over the USB HID protocol. The YubiKey NEO and YubiKey 4 include protocols such as OpenPGP card using 2048-bit RSA and elliptical curve cryptography (ECC) p256 and p384, Near Field Communication (NFC), and FIDO U2F. The YubiKey allows users to sign, encrypt and decrypt messages without exposing the private keys to the outside world. The 4th generation YubiKey launched on November 16, 2015. It has support for OpenPGP with 4096-bit RSA keys, and PKCS#11 support for PIV smart cards, a feature that allows for code signing of Docker images.[8][9]

Founded in 2007 by CEO Stina Ehrensvärd, Yubico is a private company with offices in Palo Alto, Seattle, and Stockholm.[10] Yubico CTO, Jakob Ehrensvärd, is the lead author of the original strong authentication specification that became known as Universal 2nd Factor (U2F).[11]

ModHex

The YubiKey emits passwords in a modified hexadecimal alphabet, which is designed to be as independent of system keyboard settings as possible. This alphabet, referred to as ModHex or Modified Hexadecimal, consists of the characters cbdefghijklnrtuv, corresponding to the hexadecimal digits 0123456789abcdef.[12]

Security-concerns YubiKey 4 (closed-source code)

Yubico has replaced all open-source components in YubiKey 4 with closed-source code, which can no longer be independently reviewed for security flaws.[13] Yubico states that internal and external review of their code is done. Yubikey NEOs are still using open-source code.[14] On May 16, 2016, Yubico CTO Jakob Ehrensvärd responded to the open-source community's concerns with a blog post [15] affirming the company's strong open source support and addressing the reasons and benefits of updates to the YubiKey 4.


List of supported services/platforms

See also

References

  1. ↑ "Specifications Overview". FIDO Alliance. Retrieved 4 December 2015.
  2. ↑ "What Is A Yubikey". Yubico. Retrieved 7 November 2014.
  3. ↑ McMillan (3 October 2013). "Facebook Pushes Passwords One Step Closer to Death". Wired. Retrieved 7 November 2014.
  4. ↑ Diallo, Amadou (30 November 2013). "Google Wants To Make Your Passwords Obsolete". Forbes. Retrieved 15 November 2014.
  5. ↑ Blackman, Andrew (15 September 2013). "Say Goodbye to the Password". The Wall Street Journal. Retrieved 15 November 2014.
  6. ↑ "YubiKey Authentication". LastPass. Retrieved 15 November 2014.
  7. ↑ "KeePass & YubiKey". KeePass. Retrieved 15 November 2014.
  8. ↑ "Launching The 4th Generation YubiKey". Yubico. Retrieved 20 November 2015.
  9. ↑ "With a Touch, Yubico, Docker Revolutionize Code Signing". Yubico. Retrieved 20 November 2015.
  10. ↑ "The Team". Yubico. Retrieved 12 September 2015.
  11. ↑ "History of FIDO". FIDO Alliance. Retrieved 16 March 2017.
  12. ↑ E, Jakob (12 June 2008). "Modhex - why and what is it?". Yubico. Retrieved 6 November 2016.
  13. ↑ Ryabitsev, Konstantin. "I must, sadly, withdraw my endorsement of yubikey 4 devices (and perhaps all ...". Google+. Retrieved 12 November 2016.
  14. ↑ "dainnilsson commented on 11 May". Github. Retrieved 12 November 2016.
  15. ↑ "Secure Hardware vs. Open Source". Yubico.com. Retrieved 16 March 2017.


This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.