• 2xsaiko
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    3
    ·
    9 months ago

    Yubikey is only really useful for authentication with a trusted party, and not decryption. You can technically use store a secret key on it but then its two biggest advantages are gone, namely that you can’t copy the key and that it doesn’t use the limited storage on the device.

    • cley_faye@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      9 months ago

      The yubikey can perform a hmac using a secret (supposedly) only available to the key’s internals. This is used in addition to the password, so that knowledge of the password without the key, or the key without knowledge of the password, can’t be used to decrypt the database. It’s kind of a half second factor (I know it’s not technically correct to call it that, but I hope you get the idea).

      It’s also in their doc (that they use challenge/response): https://keepassxc.org/docs/ and is even featured on yubico’s website, which is somewhat weird but why not: https://www.yubico.com/works-with-yubikey/catalog/keepassxc/#tech-specs

      The issue GP had is probably that the keepass app does not support it on Android.

      • 2xsaiko
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        4
        ·
        9 months ago

        You can absolutely copy the key, because the device has to give it up to the application during decryption. Or does the application send the encrypted file to the yubikey for it to decrypt it? In which case, that’s a lot better and I’m wrong.

        • tux7350@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          9 months ago

          You use a GPG key that you then add to the yubikey. The keys can only be written or deleted off the yubikey, you can’t read the secret once written. Then you can use the GPG key to either encrypt a file or sign it. Check out Pretty Good Privacy and the GnuPrivacy Guard software for more information on how that works.

          I use my yubikey to encrypt files, sign my work in Git, as well as the usual password authenticator stuff. You can still use FIDO, U2F and OTP codes while using the GPG too.

          Check out this awesome guide on how to setup an airgapped computer to generate the GPG key. https://github.com/drduh/YubiKey-Guide

        • Natanael@slrpnk.net
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          9 months ago

          You’re talking past each other, some Yubikeys have PGP apples for asymmetric encryption (public / private keypairs), and HMAC is a symmetric single key algorithm where the yubikey sends a resulting value to the PC/phone which is part of the key derivation inputs (even though the yubikey’s root key remains secret).

        • miss phant@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          1
          ·
          9 months ago

          Excuse my surface knowledge on this but when setting up TOTP on Yubikey you can choose to only get an OTP on touch which would be pointless if the application had access to the secret at any point. Based on that it’s probably not possible to copy it.