• 2xsaiko@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    4
    ·
    8 months ago

    You can absolutely copy the key, because the device has to give it up to the application during decryption. Or does the application send the encrypted file to the yubikey for it to decrypt it? In which case, that’s a lot better and I’m wrong.

    • tux7350@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      8 months ago

      You use a GPG key that you then add to the yubikey. The keys can only be written or deleted off the yubikey, you can’t read the secret once written. Then you can use the GPG key to either encrypt a file or sign it. Check out Pretty Good Privacy and the GnuPrivacy Guard software for more information on how that works.

      I use my yubikey to encrypt files, sign my work in Git, as well as the usual password authenticator stuff. You can still use FIDO, U2F and OTP codes while using the GPG too.

      Check out this awesome guide on how to setup an airgapped computer to generate the GPG key. https://github.com/drduh/YubiKey-Guide

    • Natanael@slrpnk.net
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      8 months ago

      You’re talking past each other, some Yubikeys have PGP apples for asymmetric encryption (public / private keypairs), and HMAC is a symmetric single key algorithm where the yubikey sends a resulting value to the PC/phone which is part of the key derivation inputs (even though the yubikey’s root key remains secret).

    • miss phant@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      1
      ·
      8 months ago

      Excuse my surface knowledge on this but when setting up TOTP on Yubikey you can choose to only get an OTP on touch which would be pointless if the application had access to the secret at any point. Based on that it’s probably not possible to copy it.