3 ms·

https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ These guys are the leaders in small USB crypto keys. Yes th

by ttul 8y ago

https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ These guys are the leaders in small USB crypto keys. Yes their devices offload various crypto routines; and they are cheap.

gcb0 8y ago
they are not cheap as they are not even close to usable out of 2nd factor auth flows. actual hardware acelerators for servers and real world loads are much more expensive though, but you get much more than this. also the interface to yubikeys is a usb hid, much more trivial to exploit than the article's issue.
- mynameisvlad 8y ago
  Well, firstly, they have HSM-grade hardware available as well. Secondly, they have crypto processors that let you use PGP or PKCS11 certificates with the private key and certificate operations happening on the device, directly integrated into native system utilities. Also, source on them being "much more trivial to exploit than the article's issue"? The only issue I've heard with Yubikey's certificate operations was https://www.yubico.com/keycheck/ https://www.yubico.com/keycheck/ where they also provided anyone affected with a replacement key at no charge.
  - gcb0 8y ago
    > less secure vou posted on a thread about one process stealing memory from another using cpu delays. yubi key expose a device (or type as a usb keyboard), which every single user process have access to.
    - mynameisvlad 8y ago
      > yubi key expose a device (or type as a usb keyboard), which every single user process have access to So? Are there any actual exploits you'd like to share that take advantage of either of these? Or are you just speaking in hypotheticals? Because in that case, basically everything you do on any computer that isn't airgapped (and even that can be exploited) is going to theoretically be exploitable.
bcaa7f3a8bbc 8y ago
> "offload various crypto routines" This is a misconception. These crypto keys are only designed to protect RSA and ECC private key, and encrypt symmetric key instead of actual data, for good reasons. The actual symmetric encryption is still performed on the host computer, the actual AES key can still be stolen from a CPU side-channel. Are these tokens any good? Yes, they guard your private key. Is it enough to protect you from Spectre? No.

by ttul 8y ago

gcb0 8y ago

they are not cheap as they are not even close to usable out of 2nd factor auth flows. actual hardware acelerators for servers and real world loads are much more expensive though, but you get much more than this. also the interface to yubikeys is a usb hid, much more trivial to exploit than the article's issue.

mynameisvlad 8y ago
Well, firstly, they have HSM-grade hardware available as well. Secondly, they have crypto processors that let you use PGP or PKCS11 certificates with the private key and certificate operations happening on the device, directly integrated into native system utilities. Also, source on them being "much more trivial to exploit than the article's issue"? The only issue I've heard with Yubikey's certificate operations was https://www.yubico.com/keycheck/ https://www.yubico.com/keycheck/ where they also provided anyone affected with a replacement key at no charge.
- gcb0 8y ago
  > less secure vou posted on a thread about one process stealing memory from another using cpu delays. yubi key expose a device (or type as a usb keyboard), which every single user process have access to.
  - mynameisvlad 8y ago
    > yubi key expose a device (or type as a usb keyboard), which every single user process have access to So? Are there any actual exploits you'd like to share that take advantage of either of these? Or are you just speaking in hypotheticals? Because in that case, basically everything you do on any computer that isn't airgapped (and even that can be exploited) is going to theoretically be exploitable.

bcaa7f3a8bbc 8y ago

> "offload various crypto routines" This is a misconception. These crypto keys are only designed to protect RSA and ECC private key, and encrypt symmetric key instead of actual data, for good reasons. The actual symmetric encryption is still performed on the host computer, the actual AES key can still be stolen from a CPU side-channel. Are these tokens any good? Yes, they guard your private key. Is it enough to protect you from Spectre? No.