I have a YubiKey 4 and want to use it to store a private key that should never enter a computer system's memory. After importing the key to the device I understand it never leaves it. Do the signing/decryption operations that take place for plain text using the private key happen on the device's hardware? Also, if this does happen on hardware, then can it be used like an HSM if proper compliance does not require that it generate the key on the device?
$\begingroup$
$\endgroup$
9
-
$\begingroup$ I can't believe I made that many mistakes in one paragraph!! Thanks for the suggested edits. I rewrote the question a couple of times so the grammatical mistakes were due to a lack of time on my part. Thanks. Hope you don't catch any more errrors. =) $\endgroup$– sammanCommented Aug 1, 2019 at 16:59
-
$\begingroup$ Signing is on device. Decryption is mixed, since hybrid encryption is the default. The ciphertext is encrypted symmetrically, this symmetric key is encrypted with the asymmetric key. So the device decrypts the symmetric key, which would then typically be given to the host computer so it can decrypt the full message. $\endgroup$– NatanaelCommented Aug 2, 2019 at 18:14
-
$\begingroup$ What do you mean by decryption is mixed? Where is that documented? Where is this symmetric key stored? Is the symmetric key stored in the Microsoft cryptographic provider and is that encrypted by the private key as you stated? If what I am saying in my questions is all true and I understand correctly then the answer is that the decryption is happening on the OS and not the YubiKey. Is this symmetric key accessible if a person were to compromise the system and obtain root privileges so that they can decrypt further messages. I understand the concept but not the implementation with Microsoft. $\endgroup$– sammanCommented Aug 3, 2019 at 20:10
-
$\begingroup$ To further clarify that symmetric key would at some point be in memory and what are the implications for other cipher text if the symmetric key were to be compromised. $\endgroup$– sammanCommented Aug 3, 2019 at 20:13
-
$\begingroup$ each message gets a unique secret symmetric key, only used for that message. The symmetric key is encrypted to the public key, sent along with the message ciphertext. The Yubikey applet decrypts the symmetric key with the private key, sends the symmetric key to the OS. The OS decrypts the full message. $\endgroup$– NatanaelCommented Aug 4, 2019 at 16:32
|
Show 4 more comments
1 Answer
$\begingroup$
$\endgroup$
4
From the official specifications, published by NIST;
https://csrc.nist.gov/publications/detail/sp/800-73/4/final
NIST Special Publication 800-73-4 Interfaces for Personal Identity Verification – Part 1: PIV Card Application Namespace, Data Model and Representation
A.5 Key Establishment Schemes with the PIV Key Management Key
FIPS 201 specifies a public key pair and associated X.509 Certificate for Key Management. The key management key (KMK) is further defined in SP 800-78, which defines two distinct key establishment schemes for the KMK:
A.5.1.1 RSA Key Transport with the PIV KMK
As specified in SP 800-78, the on-card private KMK can be an RSA transport key that complies with [PKCS1]. In the scenario described above, a sender encrypts a symmetric key with the KMK’s public RSA transport key. The role of the on-card KMK private RSA transport key is to decrypt the sender’s symmetric key on behalf of the cardholder and provide it to the client application cryptographic module
The client application cryptographic module would typically mean the software on the computer that you connected the card to. It means that RSA operations happens on the card, but the computer will then decrypt the full message. It's designed this way to not make the card a bottleneck for large messages.
The Yubikey mostly follows the official spec for these protocols.
-
$\begingroup$ If I were to use the RSA mechanism without treating the card as a PIV but rather a secure store for the private key then technically it is feasible to have RSA operations be performed on the card. I have actually accomplished this in C# utilizing the Windows crypto API. Basically I am trying to produce a makeshift cheap version of HSM for the RSA only operations. I was able to also encrypt with the private key as well if my memory serves me well. I will look at the code again but based on the above statement it seems that you can use it for decrypting only. Can one sign with the private key. $\endgroup$– sammanCommented Aug 7, 2019 at 18:18
-
$\begingroup$ I don't remember if I just did decrypt on the card utilizing the certificate. I might have done the opposite but do you think that was possible? I need to find the code or rewrite it. I wanted these signing mechanisms to allow my end users to be able to securely sign things without compromising their private keys even myself on the client end. $\endgroup$– sammanCommented Aug 7, 2019 at 18:25
-
$\begingroup$ Thanks for your effort I really appreciate you finding those specs relating to the YubiKey. $\endgroup$– sammanCommented Aug 7, 2019 at 18:28
-
$\begingroup$ @samman yes, you can sign. That's covered elsewhere in the documents $\endgroup$– NatanaelCommented Aug 7, 2019 at 20:42