4 ms·
Really, there needs to be some way to add a secondary key that's in secure storage without removing it from secure storage.
by tbrownaw 4y ago
Really, there needs to be some way to add a secondary key that's in secure storage without removing it from secure storage.
- twawaaay 4y agoIn realm of real hardware security modules this is actually simple, at least in theory. (I worked as a security officer for credit card payment company and we had real HSM boxes worth small fortune each). What you do is you initialise the hardware device with same cryptographic material. You can make as many clones as you want, securely. In practice it is a huge headache but it is due to amount of procedures and paperwork you need to do. Now, I am not an expert on Yubikeys and the protocols used by these tokens, but I know they have protection against reply attacks meaning they keep the sequence number that is incremented for each challenge/response. Pretty sure it could be made to support multiple keys. It would be really nice if I was able to initialise multiple yubikeys and use them interchange-ably (and keep two in safe deposit box just in case).