Yubikey prior to 5.7 firmware can be cloned with physical access within a โfew minutesโ
learned this from @jonah
we're discussing it here:
https://discuss.privacyguides.net/t/eucleak-yubikey-5-can-be-cloned-in-a-matter-of-minutes/20585
Since @nitrokey recently received certification, how much has the scales shifted in their direction?
"These security microcontrollers are present in a vast variety of secure systems โ often relying on ECDSA โ like electronic passports and crypto-currency hardware wallets but also smart cars or homes. However, we did not check (yet) that the EUCLEAK attack applies to any of these products."
who knows what other products may be affected by the presence of these microcontrollers?
Original news source: https://ninjalab.io/eucleak/
Yubikey prior to 5.7 firmware can be cloned with physical access within a โfew minutesโ - neat! The attack requires physical access to the secure element (few local electromagnetic side-channel acquisitions, i.e. few minutes, are enough) in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device. As they note, for most casual Yubikey users there is no need for concern/replacement: Authentication tokens (like FIDO hardware ...
๐ฌ๐ข๐ญ๐๐ฅ๐ข๐โคโฟ๐ฌ๐ฎศ๐๐ง
