4 ms·
> - Cryptocurrency hardware wallets like Ledger and Trezor Ledger hardware wallets (which btw can serve as U2F authentication but, AFAIK, not FIDO2) are protec
by TacticalCoder 2y ago
> - Cryptocurrency hardware wallets like Ledger and Trezor
Ledger hardware wallets (which btw can serve as U2F authentication but, AFAIK, not FIDO2) are protected by a PIN: three wrong PINs and the device, unlike a Yubikey, factory resets itself.
IIUC the side-channel attack relies on a non constant-time modinv.
I don't know if there's a way to force that modinv to happen on a Ledger without knowing the PIN. I take it we'll have a writeup by Ledger on that attack very soon.
- Xylakant 2y agoYubikeys don’t use a pin by default, but at least the ones I use all have the option to set one.
- lxgr 2y agoWhether a PIN is used is determined by the RP on a per-authentication basis, so unfortunately this attack likely breaks that mechanism.
- traceroute66 2y ago> Whether a PIN is used is determined by the RP on a per-authentication basis Ahem, cough... ykman fido config toggle-always-uv
- deleted 2y ago[deleted]