21–30 of 47 posts
The kickstarter page mentions that Solo supports U2F and Fido2. What else does it support?
Is it like the Yubico "security key" with just U2F and fido2 or does it support OTP, OpenPGP, Smart cards, PKCS11? How long are the keys it stores?
Oh, and if it doesn't support some or any of that stuff, is it a software or a hardware limitation?
I'm still waiting for another manufacturer to even come close to the physical design of yubikeys.
If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is t…
Yes. When registering a credential you can request[1] attestation information. Generally this will come in the form of an X.509 certificate[2] per batch of 100,000 devices which is signed by the manufacturer and which signs the generated key.
FIDO is planning on running a central registry[3] of devices which should include their certifications and manufacturer public keys etc.
For more details, see [4].
> My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature.
That's correct: CTAP1 just signs things. You can prove to a remote service that the credential is in live use right now because it signs over a server-provided nonce to show freshness, but that's all.
With CTAP2, devices can store keys themselves and they can provide a random oracle (i.e. HMAC) for unlocking locally encrypted data[5]. FIDO2 devices can also require a PIN to be provided before keys are released. (Or have a local fingerprint reader, although I don't know of any such devices yet.)
[1] https://www.w3.org/TR/webauthn/#attestation-convey [2] https://www.w3.org/TR/webauthn/#fido-u2f-attestation [3] https://fidoalliance.org/mds/ [4] https://www.imperialviolet.org/2018/03/27/webauthn.html#atte... [5] https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...
Congrats for launching! The kickstarter page mentions that Solo supports U2F and Fido2. What else does it support? Is it like the Yubico "security key" with just U2F and fido2 or does it support OTP, OpenPGP, Smart cards, PKCS11? How long are the keys it stores? Oh, and if it doesn't support some or any of that stuff, is it a software or a hardware limitation?
I read this as they don't support OpenPGP yet, but they do say "256 KB of memory to support hardened crypto implementations and OpenPGP" so I'd guess it's on the to-do list.
If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is t…
1b. Solo will have its own attestation certificate, so you'd be able to say I wan't/don't want to accept Solo. I believe this will be more valuable to enterprise/closed environments that publicly available services, but of course an option.
2. FIDO2 and "1" (U2F) work pretty much the same. The device signs a challenge together with the hostname of the website you're visiting. There's no release of any key material. Yubikes, other than FIDO2/U2F, support other protocols including OpenPGP or SSH, but this is kind of a different story. Makes sense?
[1] https://fidoalliance.org/fido-technotes-the-truth-about-atte...
$200K - Hidden Surprise! I'm not sure how much I like an open source security appliance coming with a "hidden surprise".
Right now the killer feature of yubikeys for me is the fact that they're waterproof and have no physical buttons to wear out, making them effectively indestructible on my keychain. I'm still waiting for another manufacturer to even come close to the physical design of yubikeys.
But being open, you can take the design, change the button to be a touch sensor, and make your own. If anyone does it, please keep us posted, we want to support you!
Congrats for launching! The kickstarter page mentions that Solo supports U2F and Fido2. What else does it support? Is it like the Yubico "security key" with just U2F and fido2 or does it support OTP, OpenPGP, Smart cards, PKCS11? How long are the keys it stores? Oh, and if it doesn't support some or any of that stuff, is it a software or a hardware limitation?
"By having singed code we can offer firmware upgrade, to release new features such as OpenPGP ..." I read this as they don't support OpenPGP yet, but they do say "256 KB of memory to support hardened crypto implementations and OpenPGP" so I'd guess it's on the to-do list.
If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is t…
> Is there anything in the standard about proving to the server that you have a genuine FIDO device Yes. When registering a credential you can request[1] attestation information. Generally this will come in the form of an X.509 certificate[2] per batch of 100,000 devices which is signed by the manufacturer and which signs the generated key. FIDO is planning on running a central registry[3] of devices which should inc…
A FIDO2 device with fingerprint reader was supposedly launched at RSA 2018 [1][2].
[1] https://mobileidworld.com/fido2-compliant-usb-key-fingerprin...
[2] https://www.slideshare.net/FIDOAlliance/fido-kwg-tech-semina...
Why would I choose this over the Yubikey, or even Google's offering? And I didn't see on the kickstarter (I may have missed it), where are these being produced? I know people were not interested in Google's because they were being made in China.
I think "open source" is the key selling point, along with being able to hack on the hardware and reflash the firmware. I'm 5/5 happy with my current yubikeys, but I'm also really glad that there's competition in this area and not a monoculture.
Yubico is also a very open company. What is closed today is the industry of secure processors, and this is what we hope we can change.
Plus, with more and more open source, we can expect more and more adoption of the standard. Ten years ago there was spam, now it's gone. Now there's phishing, maybe in a few years it'll be gone too.