Once and Still a Techie Weblog

Yubico’s Ubiquitous to be Yubikey

It’s incredibly secure, uber-convenient, open source, and you won’t have to pay a recurring subscription fee to use it. The Yubico Yubikey is a breakthrough in personal authentication technology that leaves other existing technologies like VeriSign’s Identity Protection seasick in its wake.

To start off with a little comparo, here’s how VeriSign’s VIP works according to their site:

VeriSign Identity Protection (VIP) protects your accounts and your identity by requiring a unique security code, in addition to your username and password, to access your online accounts. To generate a security code, you use a VIP credential (such as a USB flash drive or VIP Security Token that you carry with you) that generates a series of numbers unique to that VIP credential. While usernames and passwords can be guessed or otherwise discovered, only you have access to the physical device that generates the security codes you need to identify yourself.

If you’ll notice, the Verisign “football” above generates a 6 character code that the user physically types into a field on some web form that needs to be submitted for authentication. The Yubikey uses the same concept of generating a one-time security passcode with one major difference: the passcode is 32 characters (128 bits) long. How the Yubikey does it’s job is so much more convenient as all a user has to do is press a single button on the device and it’ll generate that passcode and type it out for you. It can “type” the code out because the device appears to the computer as a standard USB HID device, kinda like a standard keyboard which can be practically plugged into any computer that has a USB port running whatever Operating System (MacOS, Windows, Linux, it doesn’t matter) it’s OS independent/cross platform. Every time you press the button, it encrypts some data using a built-in secret 128-bit AES key and blurts it out as a passcode. When you submit the web form with the passcode, this information is sent to your security provider’s authentication server which looks up the symmetric key in its database to decrypt the data and effectively authenticate you.

Yubico’s part in all this is providing interested parties the tools to build their own secure authentication solution by selling the Yubikey device itself and providing an SDK (Software Development Kit) which anyone can download from their site. Which is miles away from VeriSign’s or many other “Authentication providers’” business model of having you sign up for their service and basically relying on their authentication servers and infrastructure which can get pretty expensive.

Practical applications for Yubikey are authenticating customers to allow access to their online banking service, logging on to an eCommerce site, for posting comments on a blog using an OpenID or any other online service that elects to use the technology.

For example, let’s say a pharmaceutical company is interested in rolling this out to their medical representatives in the field who need to be able to remotely and securely access their corporate intranet to submit reports and what not. They can buy the keys in bulk from Yubico and download the SDK from their site which is open source and free, by the way, then develop and install custom software on a dedicated company server whose main job is to authenticate the folks using Yubikey to log into their intranet.

Yubico comes from the word ubiquitous ‘coz they didn’t want to come up with a name based on some crappy, unoriginal, security-related term like verify, secure or encryption. They envision the Yubikey as something you will one day find being used everywhere well-known for its ubiquity.

Read up on this awesome product at their website Yubico.com