YubiKey Cloning Attack: Difference between revisions
LTrifunovic (talk | contribs) (Created page with "== Summary == YubiKey Cloning Attack == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == Used Hardware == Device to be used with this documentation [...") |
LTrifunovic (talk | contribs) No edit summary |
||
| Line 1: | Line 1: | ||
== Summary == | == Summary == | ||
YubiKey | A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA). | ||
The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key. | |||
However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7. | |||
== | == General == | ||
=== Passwords as a Foundation === | |||
=== Modern Authentication Methods === | |||
== | === xxx === | ||
== Courses == | == Courses == | ||
Revision as of 16:38, 18 December 2024
Summary
A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA). The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key. However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7.
General
Passwords as a Foundation
Modern Authentication Methods
xxx
Courses
- A course where this documentation was used (2017, 2018)
- Another one (2018)