3 ms·
Information is light about an actual Proof of Concept here. I have no actual knowledge, and it makes sense to assume the PIN is required to implement the EM si
by sounds 2y ago
Information is light about an actual Proof of Concept here.
I have no actual knowledge, and it makes sense to assume the PIN is required to implement the EM side channel attack, as without a valid PIN the old, vulnerable Infineon library most likely does not complete all the steps.
- lxgr 2y agoRequiring/not requiring the PIN is a per-authentication flag that the RP can set though, as far as I know. Since the RP challenge is not authenticated in any way, nothing seems to prevent an attacker from just preparing a "user verification not required" challenge and getting the Yubikey to sign it.
- lxgr 2y agoOh, potentially important corollary: This means that this vulnerability allows breaking an “always UV” credential as well: - Do as many UP-only challenges as required on a stolen Yubikey to extract the private key, not involving the RP (or maybe a single incomplete one, to discover the credentialID) - Use the recovered private key in an UV challenge against the RP