You are not logged in.
I always used a secure passphrase to achieve Full Disk Encryption with LUKS.
Yesterday I added the possibility to unlock my disk via FIDO2 with the new systemd-cryptenroll --fido2-device functionality.
When I start my machine, it prompts me to enter my FIDO2 Pin and then press the button on my YubiKey. Everything works but I am wondering how secure this thing is.
With a regular passphrase, the key is derived with the help of the Argon function. How secure is a FIDO2 YubiKey with a pin, if somebody were to get my physical YubiKey but not know the pin?
Assume that the pin has high entropy and is ca. 30 characters long,
Offline
Looking at https://github.com/systemd/systemd/blob … ido2.c#L10 first it uses https://github.com/systemd/systemd/blob … til.c#L524 followed by https://github.com/systemd/systemd/blob … til.c#L155
Offline
How secure is a FIDO2 YubiKey with a pin
If the PIN is entered incorrectly a total of 8 times in a row, the FIDO2 function will become blocked, requiring that it be reset.
--
saint_abroad
Offline
bogstefan wrote:How secure is a FIDO2 YubiKey with a pin
If the PIN is entered incorrectly a total of 8 times in a row, the FIDO2 function will become blocked, requiring that it be reset.
A reset in this context is effectively a re-key.
--
saint_abroad
Offline