Yubico To Replace Vulnerable YubiKey FIPS Security Keys

'Yubico said today it plans to replace certain hardware security keys
because of a firmware flaw that reduces the randomness of
cryptographic keys generated by its devices. From a report:

Affected products include models part of the YubiKey FIPS Series, a
line of YubiKey authentication keys certified for use on US government
networks (and others) according to the US government's Federal
Information Processing Standards (FIPS). According to a Yubico
security advisory published today, YubiKey FIPS Series devices that
run firmware version 4.4.2 and 4.4.4 contain a bug that keeps "some
predictable content" inside the device's data buffer after the
power-up operation.

This "predictable content" will influence the randomness of
cryptographic keys generated on the device for a short period after
the boot-up, until the "predictable content" is all used up, and true
random data is present in the buffer. This means that for a short
period after booting up YubiKey FIPS Series devices with the affected
4.4.2 and 4.4.4 versions will generate keys that can be either
recovered partially, or in full, depending on the cryptographic
algorithm the key is working with for a particular authentication
operation.'

-- source: https://tech.slashdot.org/story/19/06/13/1844232

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug