The OTP contains of a static 12 character identifier +32 characters OTP. By pressing a pad on the key, a one time password is generated, encrypted with that key consisting of of key id, counters and timers, a random nonce and a checksum (see Section 2 of )

Yubikey Neo: Additional smartcard features and NFC (50 dollars)Įach Yubikey ships with a unique 128 bits AES key.

Yubikey Edge: Supports U2F in addition (for Google Apps) (30 dollars).

Yubikey Standard: Only supports the Yubikey OTP protocol (25 dollars).

All Yubikeys also come in nano variants which are only the size of the actual USB connector, but that doesn't seem desirable in terms of robustness.

They come in three different variants (princes are single unit prices, volumes are cheaper). As a result, all OSes more recent than MS-DOS support it out of the box.

From the operating system point of view they present themselves as a USB keyboard: The Yubikeys have a small touchpad, if that is touched the generated password is emitted via 'keyboard input'. Yubikeys are a simple, robust USB form factor.

Developed by people deeply involved in the FOSS and security communities.

FOSS-friendly, entire software stack is open source and included in Debian (all enduser tools are also available on Mac OS X).

Yubikey, as produced by Yubico is the most sensible hardware option: Hardware choice for an authentication token: The hardware design of the authentication tokens ensures that keys cannot be extracted, so in case of a compromised notebook the attacker does not have access to the second factor. If somone compromises a notebook of a user with cluster access, the attacker can steal the SSH key/passphrase and access the cluster. The important security property to gain is protection against compromised notebooks endpoint security is one of the biggest risks for the WMF cluster (especially on Mac OS X). Summarising some bits already mentioned at the offsite along with further tests done and a plan how to move forward (see below).

Yubikey open source alternative