Questions tagged [yubico]
This tag should be used for all products provided by the Yubico company, such as Yubikey, a two-factor authentication hardware key.
116
questions
1
vote
1
answer
116
views
while using WebAuthn in FF why does navigator.credentials.get() return "DOMException: The request is not allowed by the user agent or the platform..."
I'm trying to implement WebAuthn but while calling navigator.credentials.get() it always returns DOMException: The request is not allowed by the user agent or the platform in the current context, ...
1
vote
0
answers
45
views
How to export and then import an asymmetric key [Yubico]
I am trying to export and then import a Key from and into a YubiHSM2 device. I am using the Yubishell for the moment.
* Here we create a key to be wrapped
generate asymmetric 0 0 my_ecckey 1 sign-...
0
votes
0
answers
36
views
Cannot find Yubikey devices using python-yubico library on Windows 10
I'm looking to integrate 2FA into a Python app using the python-yubico library. To that end, I'm trying to run the following example they've given:
import sys
import yubico
try:
yk = yubico....
0
votes
0
answers
18
views
How to retrieve Yubikey's model with a NFC connection
My Android application connects to a Yubikey using NFC and create a PivSession:
yubiKitManager.startNfcDiscovery(new NfcConfiguration(), this, device -> {
if (device.isYubiKey()) {
...
0
votes
1
answer
139
views
Why is Linux OS having an issue with registration and authentication on webauthn.io using yubikey 5 over NFC whereas it supports usb based only?
Webauthn.io in Linux OS asks for usb based registration and authentication.It does not support yubikey over NFC due to some issue.
I tried using my yubikey over omnikey reader for testing on Webauthn....
0
votes
0
answers
394
views
Signtool to sign exe with HSM key token & code sign certificate
Its bit of learning ride so far so not sure if I have got full understanding of the subject. I will give it a try to explain the problem:
I need to sign a EXE file using the code signing certificate ...
1
vote
0
answers
56
views
Authentication failure when multiple non-discoverable credentials are registered
I've two devices which does not send userHandle during the WebAuthn authentication. But once both of the devices are registered, one of two is not allowed to login.
Caused by: java.lang....
0
votes
0
answers
30
views
Howto Verify HOTP codes
I'm making an application that has a two-factor authentication. We want to use HOTP type OAUTH with SHA1 encryption and 6 digits.
We were unable to perform data verification on a local server.
We have ...
0
votes
0
answers
390
views
Failing to generate ed25519-sk key pair | Key enrollment failed: unknown or unsupported key type
I am trying to generate ed25519-sk and ecdsa-sk keys using ssh-keygen on my Windows computer. I have OpenSSH OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3 installed and Yubikey Firmware version: 5.4.3. ...
0
votes
0
answers
19
views
How to Make Sure a Security Key Still Works for My User Accounts?
I have registered two Security Keys to my user accounts at e.g. Apple, Google or Microsoft.
I may not have to use them on these accounts for years.
So how do I make sure that they still work correctly ...
5
votes
2
answers
563
views
Yubico private key certificate signing no longer works with openssl3
I store my PKI CA certificate and private key on a Yubikey and used it to issue end user certificates but after upgrading to openssl3 from openssl1 this no longer works.
The script that I have used to ...
0
votes
0
answers
78
views
Is it possible to rotate signing keys via apksigner when key is stored on YubiKey (PKCS11 protocol)?
The Android app I'm working on is manually signed with a private key that is stored on a physical YubiKey device, which utilizes the PCKS#11 protocol.
Now that Play App Signing has been around for ...
0
votes
1
answer
99
views
Storing and Retrieving Data with WebAuthn
I would like to use WebAuthn to securely store and retrieve some senstive information on mobile Safari.
I mention Safari specifically because it is my main target browser and the storage and retrieval ...
1
vote
1
answer
327
views
github / RSA key problems preventing cargo from updating crates
I recently configured my Yubikey to sign commits on github. That is working perfect. An unfortunate by-product of the yubikey seems to be that I have to authenticate with my yubikey even just to ...
0
votes
1
answer
91
views
Yubico SDK and FIDO Device
I'm writing a client application using yubico.Yubikey SDK in .Net. I'm trying to write a code which can fetch "FEITIAN" USB FIDO device connected to my laptop. Though Yubico and FEITIAN are ...
1
vote
1
answer
1k
views
Why can't I connect to github with my ssh key on yubikey
I have an SSH key generated on my desktop as well as one generated on my yubikey. Both are ED25519 keys, with the one on the yubikey being an ED25519-sk for the security key. When I run "ssh -t ...
1
vote
1
answer
765
views
ssh yubikey: "Unable to load resident keys: device not found"
I use SSH keys stored on a Yubikey. Today I got the following message when adding my keys to the ssh-agent, as usual:
$ ssh-add -K
Enter PIN for authenticator:
Provider "internal" returned ...
0
votes
1
answer
218
views
Yubikey OTP Programming Issue with AccessCode
I am building a web application in C# to program Slot1 on a YubiKey for OTP. I am successfully able to program the key unless the configuration has been protected. The serial number was used to ...
5
votes
1
answer
566
views
Yubikey API access via NFC
Device and Environment
Secure Element (currently) used: Yubikey 5 NFC
OS (currently) used: Linux (future targets will be Win and Android)
Readers used: ACS ACR122U, REINER SCT cyberJack RFID, SCM ...
0
votes
1
answer
261
views
How to tell which application my Yubikey is using?
According to Yubico, the Yubikey 5 supports many different "applications": OTP, OATH, PIV, and FIDO/U2F to name the main ones.
My question is... how do I know which one my Yubikey is using ...
1
vote
1
answer
4k
views
Yubikey PIV "The smartcard cannot perform the requested operation."
I am trying to use a Yubikey to authenticate with Microsoft's AAD CBA however when I connect the Yubikey I get the error:
The Smart card cannot perform the requested operation or the operation ...
4
votes
0
answers
321
views
yubihsm2 signatures are invalid when signing ETH transactions
I am trying to figure out how to get this yubihsm2 to work with signing eth transactions. I have been using the python lib and so far i have had some basic setup. Below is an abbreviation of what i ...
-2
votes
1
answer
62
views
Getting the following error for Yubico API call
I am trying to create a new order in yubico portal using API call via service now.
Getting the following error:
Access denied to create new email
0
votes
1
answer
324
views
Yubikey 5 HMAC-SHA1 Challenge/Response with APDU commands
I’m developping following this reference guide, I try a simple HMAC-SHA1 Challenge/Response with APDU commands.
I tested the APDU commands with a Yubikey 4 : it works without problems
Using reader: &...
0
votes
1
answer
30
views
Why does yubikey-personalization claim the zeroth USB interface?
I'm looking at the _ykusb_write() function from the Yubikey-Personalization package and the first line of code executed is
int rc = usb_claim_interface((usb_dev_handle *)dev, 0);
Why is the zeroth ...
0
votes
1
answer
434
views
Yubikey PIV: Enforce PIN complexity
im trying to enforce PIN complexity for PIV certificates.
The PIV Manager (which as i understand is no longer under developement) had an option to enforce this, but the YubiKey Manger does not have ...
0
votes
2
answers
649
views
WebAuthn : how to register an authenticator several time
I'm using Yubico demo to implement a webauthn server : https://developers.yubico.com/WebAuthn/WebAuthn_Walk-Through.html
I have implemented the CredentialRepository class to replace In Memory with ...
0
votes
1
answer
422
views
YubiHSM2: Working command sequence in yubihsm-shell won't work non-interactively on command line
I got a working sequence of commands within yubihsm-shell, but cannot get the same result when calling the shell non-interactively from the command line.
In the shell I got:
yubihsm> connect
...
0
votes
1
answer
277
views
Unable to load DLL 'Yubico.NativeShims' when trying to use Yubico SDK in .NET
I am trying to extract the X509 certificate off of my Yubikey's PIV programmatically. I am using .NET Standard 2.0 on Windows 10, and I am trying to install and use the Yubico SDK Nuget package (...
0
votes
2
answers
663
views
Howto verify a yubico otp response
I want to use yubico OTP as a second factor in my application.
Yubico OTP documentation: https://developers.yubico.com/OTP/
The following is a c#(.net 6) example which reads the OTP via console (You ...
2
votes
3
answers
2k
views
ssh-keygen on yubikey gives FIDO_ERR_PIN_AUTH_BLOCKED
ssh-keygen -vvvv -t ecdsa-sk -O resident
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
Enter PIN for authenticator:
debug3: ...
0
votes
1
answer
126
views
OTP validation response shows MISSING_PARAMETER
Issue
I am trying to use a yubikey for second factor authentication via their OTP Validation Protocol Version 2.0. Despite following all the documentation meticulously (https://developers.yubico.com/...
1
vote
3
answers
1k
views
"User is not enrolled in Duo Security" after adding a security key
I succesfully added a YubiKey to Snowflake MFA:
Next time I try to login I immediately get following "User is not enrolled in Duo Security. Contact your local system administrator." error:
...
0
votes
1
answer
375
views
YubiHSM Code-signing exporting certificate
I followed the tutorial for generating a code-signing certificate using the YubiHSM Key Storage provider available here. After creating the Certificate Signing Request (CSR) with certreq -new sign.inf ...
1
vote
1
answer
542
views
Wrapped private key with libfido2?
I am currently working my way into libfido2 and trying to figure out how to use wrapped private keys with it.
Yubico says in the FAQs that with YubiKey 5 unlimited key pairs can be used for FIDO U2F; ...
0
votes
0
answers
640
views
problem in importing private key to the token
I am trying to inject an der formated private key to a PKC11 compatible token, with the below command:
pkcs11-tool --module /path_tp/libparskey11.so --login --write-object private.der --type privkey --...
1
vote
1
answer
263
views
OTP Validation with Yubikey - issue with HMAC-SHA1 signature
I'm meeting an understanding issue with OTP validation for Yubikey
I'm trying to develop in flutter the Validation Protocol V2 (https://developers.yubico.com/OTP/Specifications/OTP_validation_protocol....
2
votes
4
answers
1k
views
WebauthN and Yubikey to generate keys for symmetric encryption in a browser. Is this hack secure?
I understand that WebauthN is designed to perform authentication, but I'd like to use my Yubikey to create symmetric encryption keys to encrypt content on my web browser without relying on a backend ...
1
vote
1
answer
205
views
Getting credential from yubikey for passwordless
Just started to play around yubikey, my question is based on the following assumptions:
Passwordless doesn't need to know the username based on the following demo
Based on this doc the ...
0
votes
1
answer
626
views
How do I decrypt a text using yubikey SDK for .NET?
I'm trying to use a yubikey for encrypting/decrypting strings in my application. By now, I wrote some methods for testing purposes. My code was based on examples I found in the official repository: ...
2
votes
0
answers
676
views
Git GPG signing for multiple authors
Is there a way to verify multiple authors signed a commit using multiple GPG keys.
My teams already use Co-Authored-by trailers in the git commit message. For compliance reasons I'm hoping to verify ...
21
votes
1
answer
13k
views
Having difficulty to get SSH with a Yubikey working with macOS monterey
I'm following the FIDO U2F instructions on https://developers.yubico.com/SSH/ on macOS Monterey with openSSH 8.6 and run into the following issue:
~ ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
...
0
votes
1
answer
163
views
Yubikey converts lower case letter of password into capital in Qt applications on Ubuntu 20.04
We have a yubikey 5 NFC with a static OTP password where the first letter is a lowercase letter. When using this password in a Qt5 application running on an Ubuntu 20.04.2 LTS device, the first letter ...
0
votes
1
answer
3k
views
Maven build breaks 'Could not find artifact com.fasterxml.jackson:jackson-base:pom:2.12.1.redhat-00001'
The maven build of our project fails with this error:
[ERROR] Failed to execute goal on project our_project:
Could not resolve dependencies for project our_package:our_project:war:our_version-...
1
vote
0
answers
486
views
Yubico YubiHSM2 connector with HTTPS access
I use Win10 for my experiments.
I want to create HTTPS access between yubihsm-shell and yubihsm-connector.
Official guidelines are not very detailed but after a while I found some relevant information ...
3
votes
2
answers
5k
views
Is it possible to add more than one YubiKey to a .kdbx file?
I'm testing Yubico YubiKey 5 NFC. I use KeePassXC to save sensible information. KeePassXC accepts YubiKeys, but only one. Is it possible to add more than one to a .kdbx file?
5
votes
3
answers
3k
views
Can I use phone as webauthn security key with Windows 10 Sign-in options
Edit: -
Look is it just me or doesn't the W3C spec say this should be happening already: -
1.2.2. Authentication
On a laptop or desktop:
User pairs their phone with the laptop or desktop via Bluetooth....
1
vote
1
answer
197
views
Does Webauthn API Allow Clients to Detect/Identify a Token?
As you may have noticed from previous questions, I'm building a web site that will support authentication via Webauthn using Yubikeys (maybe other tokens later). As part of that process I'd like to be ...
1
vote
0
answers
112
views
Source for Yubikey AAGUID Metadata?
I'm looking for a reliable machine-readable source for Yubikey AAGUID values. The most likely-looking source I see is the Yubikey Attestation Metadata, however this seems to be very incomplete. A far ...
1
vote
1
answer
949
views
Exception from WebAuthn Authentication API with Yubikey
I'm working on adding WebAuthn support to a newly-minted web site and am running into a problem during the navigator.credentials.get() call. The client is Firefox 85.0 on Fedora 33. In case it matters,...