Pilot service for Yubikey two-factor authentication

December 12, 2014

What is a Yubikey, and how does it work?

Filed under: Pilot service for Yubikey two-factor authentication — idurkacz @ 3:56 pm

A Yubikey is a small (about 3cm x 1cm x 2mm) passive USB device. When plugged into the USB port of any PC, it presents itself as a standard USB HID keyboard and, when the capacitive ‘button’ on the Yubikey is pressed, the device emits a character string which implements a one-time password (OTP).

Ignoring, for now, the details of the contents of the string, the point is that, if the string can be correctly handled as a OTP by the receiving server, the entire system is platform independent (more-or-less every PC or laptop has a USB port), and very easy to use.

Ok – so what does the ‘string’ look like? In fact, the Yubikey can operate in two different modes: either the standard proprietary ‘Yubico OTP’ mode, or ‘OATH-HOTP’ mode. (Aside: note, not ‘OATH-TOTP’: the Yubikey is unpowered, and so doesn’t have a on-board clock.) We’re currently using and testing the standard mode, though it might be that later on we move to OATH-HOTP for reasons of server-side compatability with software OTP producers.

In standard mode, then, and using its default settings, the Yubikey produces a 44 character text string in which the first 12 characters are a public id string, and the final 32 characters are an AES-encrypted OTP. Here (taken from the Yubikey manual) is an example of the output when a Yubikey is pressed three times in succession:

<-12 chars-><---------- 32 chars ---------->

You can see that the public id of the Yubikey here is fifjgjgkhchb.

What’s the content of the encrypted OTP? In essence, it’s nothing more than a monotonically-increasing integer. Authentication works as follows:

  1. Each Yubikey has a unique (symmetric) AES key.
  2. All such keys are shared between the Yubikeys, and the authentication server.
  3. On the authentication server, the AES keys are mapped to the public ids of the Yubikeys.
  4. On receipt of an OTP, the authentication server selects the appropriate AES key, decrypts the payload and, if it finds that the integer contained in the payload is larger than any previously presented by the Yubikey, authentication succeeds.

Some background

Filed under: Pilot service for Yubikey two-factor authentication — idurkacz @ 3:04 pm

There is a bit of catching up to do here …

A while ago we collectively wondered whether we could or should be using ‘two-factor authentication’ when accessing our various services. Those questions spawned a precursor project called Project 279 – Options for two-factor authentication.

It turned out that ‘two-factor authentication’ covered a wide variety of very different ‘use cases’ for us – see the various cases in the initial ‘discussion paper.’ Ideally, we’d like to investigate all of those at some stage, but, since trying to do everything at once is never a good idea, we decided to pursue the particular question of how to implement two-factor authentication for external access to our principal access gateways, namely external-facing ssh servers and Cosign-protected websites.

So we then wondered how to do that. It turns out tha the ‘obvious’ answer is to use some kind of hardware and/or software device to generate some kind of ‘one-time password’, and then to integrate the use of that password into the ssh and Cosign authentication processes. Having looked around, we decided to try to use the Yubikey hardware device for this purpose. It’s not the only such device of course, and there are software alternatives – but the hope was (and is) that if we could get ssh and Cosign working with Yubikeys then that might provide us with a good solution. And, if it didn’t, that we could probably use the experience gained to integrate other similar devices or approaches. In summary: we have to start somewhere!

So that’s the brief background. The current project has the aim of producing a pilot two-factor authentication system for ssh and Cosign, all based on the use of Yubikeys.

Initial post

Filed under: Pilot service for Yubikey two-factor authentication — idurkacz @ 2:07 pm

I’ll be using this blog site to document thoughts and progress on the Informatics internal development project Project 313: Pilot service for Yubikey two-factor authentication.

Comments from any readers are invited, and would be welcomed.

« Previous Page

Theme: Rubric.