3 ms·
50USD for what I'd guess is about 1USD of components. Not that this isn't justifiable... just the way it goes when most of the cash goes into development perha
by wonko1 10y ago
50USD for what I'd guess is about 1USD of components.
Not that this isn't justifiable... just the way it goes when most of the cash goes into development perhaps.
- 2bluesc 10y ago> 50USD for what I'd guess is about 1USD of components. These are crypto hardened chips with obfuscated ASIC layouts and other details to prevent things like power line attacks and decapping. These aren't quite your run of the mill commodity chips. Furthermore, Yubico stands behind their product. When someone hacked the key with a power line analysis attack, they released updated firmware [1]. When someone hacked the OpenPGP applet that I use for SSH, they replaced my Yubikey Neo in a hassle free manner [2]. > Not that this isn't justifiable... just the way it goes when most of the cash goes into development perhaps. When you factor in the cost of pretending that security devices don't have issues and compare it to the cost of actually handling those issues, it may not be so bad. [1] https://www.yubico.com/2014/04/improvements-physical-yubikey-attacks/ https://www.yubico.com/2014/04/improvements-physical-yubikey... [2] https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-bug/ https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-...
- 2bluesc 10y agoThe chip in my Yubikey Neo appears to be a NXP A700x[0][1]. The datasheet so short it's almost useless, but it's at least something. [0] https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-stand/ https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-... [1] http://www.nxp.com/documents/short_data_sheet/A700X_FAM_SDS.pdf http://www.nxp.com/documents/short_data_sheet/A700X_FAM_SDS....
- BostonEnginerd 10y agoI have a rather favorable impression of the company based in their responses to the incidents that you mentioned. They replaced my YK Neo without any hassle after the OpenPGP applet vulnerability was disclosed.
- sllabres 10y agoNot saying that it's not worth the money, as I'm a user of the very early Yubikey and as it is not only the hardware. But I cannot fully agree with the high costs associated with the hardened obfuscated ASIC But from what I read it is not an ASCI (which is good). The Neo has a NXP A7005 CPU [1] and a USB interface chip. The crypto part is of course in the CPU and for a NXP A7005CGHN1 I find prices below 4$ for quantities. [1] http://www.hexview.com/~scl/neo/ http://www.hexview.com/~scl/neo/
- rconti 10y agoDirt cheap compared with RSA