If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them. I know for a fact I can dump Google Authenticator keys from my Android device…
Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.
Yes, that's great for asymmetric stuff, but we're talking about TOTP, which uses a fixed symmetric key and a hashing algorithm. Unless you can run arbitrary code on the secure element, like you can with Intel and Qualcomm stuff it can't be done and even if it can be, it'd be a significant effort investment for what's probably a negligible secure it gain in practice. Still, I'd be pretty impressed if any apps did so.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
For the purposes of 2FA, your physical machine typically doesn't count as 'something you have' and your phone is really no different.
Why not? The iPhone is a personal computer (PC) after all, ironic as it may sound.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Another neat solution: https://krypt.co/
It is neat, but only for SSH. Plus, they're a new company I never heard of. Why would I trust them with my SSH keys?
Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.
Given that TOTP (one of the more common phone OTP methods, used by Google Authenticator) uses a symmetric key, it seems unlikely it’s being stored in the Secure Enclave
It may just require an extra step. My understanding of TOTP is that it's the key data (typically a string represented by a QR code) and a time offset that is used to generate the OTP. If the only thing stored on disk is the code encrypted by the secure enclave's key, and the only way the decrypted code is in memory at runtime is if it's decrypted by the secure enclave's key, then that still offers protection against some attack vectors.
You (as an attacker) could then recover the key if you had full control of the OS and could trick the user into authenticating so the secure enclave decrypts the key, but would presumably have more trouble if you (as as attacker) simply stole the device.
Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them. I know for a fact I can dump Google Authenticator keys from my Android device…
Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.
Sadly, the Secure Enclave doesn't support HMAC-SHA-1 or importing keys [1] so it's not compatible with the industry standard TOTP 2fa mechanism.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
You're thinking about authenticating your desktop, but what about authenticating the phone?
The phone itself has access to a bunch of sensitive information, and is probably much more likely to get stolen or go in for repair. Perhaps the yubikey can serve as "something I have" to supplement the iphone's pin code.