Copy keys to another device

danstiner / rust-u2f

U2F security token emulator written in Rust

Apache License 2.0

288 stars 43 forks source link

Copy keys to another device #86

Open usrfam opened 2 years ago

usrfam commented 2 years ago

Hello, friend! Please tell me where to find the private keys and how to transfer them to another computer?

danstiner commented 2 years ago

Hello, please see #68. If that answers your question, I'd be open to a PR adding a note to the README about keychain transferring.

Edit: I will note, this is something that can be done for a one time migration to a new computer, it will not work well to create two computers that use the same private keys. You should instead register both computers separately so each gets their own private key. Or buy a hardware key can can be used in either computer.

sigaloid commented 2 years ago

I will note, this is something that can be done for a one time migration to a new computer, it will not work well to create two computers that use the same private keys

Can you elaborate on this? I thought the secrets stored in the GNOME keychain were stateless. Of course, ideally you would use two separate keys, but I'm curious.

danstiner commented 2 years ago

Sure, basically U2F requires a usage counter that is sent and incremented each time you authenticate. I store and update that counter in the keychain for each entry, so there is mutable state. Maybe that's an abuse of the GNOME keychain hehe, if it is I'd love to know.

See https://developers.yubico.com/U2F/Libraries/Advanced_topics.html, "Device counters"

That's a big part of why I haven't documented cloning better. It will "just work" if you move your whole HOME dir or even just the keychain data to a new computer, but cloning will not keep the counters in sync. I'm not sure what sites would do when they see the counter step back but hopefully they would invalidate the authenticator entirely.

And yeah exactly, the ideal recommendation for now is just to register the two computers separately as two different authenticators. Unless there is some easy solution for syncing keychain entries

sigaloid commented 2 years ago

Thank you for the explanation!

chrysn commented 2 years ago

To answer these recurring question in a FAQ-style way, maybe it helps painting things like this:

'You can transfer your keys, but that is really moving them -- they need to be deleted, or otherwise services will flag your device as compromised.'
'While nothing can keep you from creating a backup of your device' (well, save #85), 'do not expect a recovered backup to work. Instead, register your backup device as a dedicated token with your service, or deposit its recovery keys at your backup site.'

(This is all of course conditional on me understanding the underlying mechanisms right, but they appear to be common in COSE based environments)

zroug commented 2 years ago

I think only related to FIDO2 (#50), but for context: Recently the FIDO Alliance has explicitly introduced multi device credentials (https://fidoalliance.org/multi-device-fido-credentials/).