Hi Nathan, Sze,<div><br></div><div>The Yubikey also seems to work well in static password mode on an iPad when coupled with the Apple iPad Camera Connection kit USB adapter.</div><div><br></div><div><a href="http://store.apple.com/us/product/MC531ZM/A" target="_blank">http://store.apple.com/us/product/MC531ZM/A</a><br>
<br>When you plug a Yubikey in it says the "connected usb device is not supported", but after dismissing the warning the Yubikey works without issues! </div><div><br></div><div>Nick Parker also found a couple of other adapters that might be able to be chained together, though we havent tested them.</div>
<div><br></div><div><a href="http://www.amazon.com/dp/B0055PCVDO/ref=asc_df_B0055PCVDO1801099?smid=AM0ICWZT1KQ3S&tag=nextagusmp0350203-20&linkCode=asn&creative=395129&creativeASIN=B0055PCVDO" target="_blank" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">http://www.amazon.com/dp/<u></u>B0055PCVDO/ref=asc_df_<u></u>B0055PCVDO1801099?smid=<u></u>AM0ICWZT1KQ3S&tag=<u></u>nextagusmp0350203-20&linkCode=<u></u>asn&creative=395129&<u></u>creativeASIN=B0055PCVDO</a><br style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><a href="http://www.amazon.com/Female-Mini-Male-Adapter-Converter/dp/B005DCTDGC/ref=sr_1_4?s=electronics&ie=UTF8&qid=1324684766&sr=1-4" target="_blank" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">http://www.amazon.com/Female-<u></u>Mini-Male-Adapter-Converter/<u></u>dp/B005DCTDGC/ref=sr_1_4?s=<u></u>electronics&ie=UTF8&qid=<u></u>1324684766&sr=1-4</a></div>
<div><br></div><div>Unfortunately, the connector does not appear to work on the iPhone, so it might be an iPad only option.</div><div><br></div><div>I'm not sure if the USB interface for HMAC challenge would work on the iPad, but we might give that a try at some point too.</div>
<div><br>Cheers,</div><div>Stephen</div><div><br><div class="gmail_quote">2012/1/5 Sze Wong <span dir="ltr"><<a href="mailto:szewong@gmail.com" target="_blank">szewong@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF"><div>Nathan and Stephen,</div><div><br></div><div>This is great information. We have been using SQLCipher for many HIPPA required projects on the iOS. To get through the 2 factor authentication requirement, we issue a separate X.509 certificate per iPad. The YubiKey should be a much cleaner approach. We are going to out that in our road map.</div>
<div><br></div><div>Thanks<br><br><div>Sze Wong</div><div>CEO, Zerion Software, Inc.</div><div><a href="tel:571-216-2553" value="+15712162553" target="_blank">571-216-2553</a></div><div><a href="mailto:swong@iformbuilder.com" target="_blank">swong@iformbuilder.com</a></div>
<div>@szewong</div><div><br></div><div><a href="http://www.iFormBuilder.com" target="_blank">www.iFormBuilder.com</a></div><div>No Paper. No Connection. No Problem.</div><div><br></div><div>This email and its contents are confidential. If you are not the intended recipient, please do not disclose or use the information within this email or its attachments. If you have received this email in error, please delete it immediately. Thank you.</div>
</div><div><div><div><br>On Jan 5, 2012, at 5:57 PM, Stephen Lombardo <<a href="mailto:sjlombardo@zetetic.net" target="_blank">sjlombardo@zetetic.net</a>> wrote:<br><br></div><div></div><blockquote type="cite">
<div>Hi Nathan,<div><br>This is great information! </div><div><br></div><div>We've been doing some investigation into Yubikey's too. We started off writing a simple Mac OS Menubar application that generates OATH TOTP token when you press a global keyboard Hot key. This uses the Yuibkey API and basically lets you sign into GMail 2-factor auth with a few keypresses (similar to the windows too avaliable at the Yubikey website). The experience was quite good, the Open Source code in the yubikey personalization project and libyubikey makes it very easy to issue an HMAC-SHA1 challenge/response to the key while it is plugged in.</div>
<div><br>This presents some interesting potential for SQLCipher. We've had some discussion on the list recently about implementing callbacks in SQLCipher to allow an application to override behavior, for example, Key derivation / management. </div>
<div><br></div><div>In particular, one neat idea we're considering as a proof of concept would be to have a key derivation callback that sends an HMAC-SHA1 challenge to the Yubikey and then mixes the result into the derived key used for encryption. Since the HMAC secret is stored security on the Yuibkey device, the result would be a SQLCipher database that could only be opened if you know the passphrase when the yubikey is actually plugged into the computer.</div>
<div><br></div><div>Callback support in SQLCipher will probably come down the road a bit, so this isn't a short term thing, but let me know what you think of this idea and how it might work for the implementations you're considering.</div>
<div><br></div><div>Thanks!</div><div><br></div><div>Cheers,</div><div>Stephen<br><br><div class="gmail_quote">On Tue, Jan 3, 2012 at 7:55 PM, Nathan of Guardian <span dir="ltr"><<a href="mailto:nathan@guardianproject.info" target="_blank">nathan@guardianproject.info</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
We have been experimenting with the Yubikey, a USB hardware password<br>
token, a bit over the last few weeks and would like to share our initial<br>
findings. We have not received any financial support or donation from<br>
Yubico for this work. We simply think they have a very affordable,<br>
interesting product that, due to its design, does *not* require any<br>
on-device driver software and can easily work with any Android device<br>
that supports USB Host/HID mode.<br>
<br>
Our motivation for investigating this device was in finding a way to<br>
encourage the use of strong (aka long, mixed-case, etc) passwords on<br>
mobile devices, for use with SQLCipher, screenlock passwords, and on<br>
boot disk encryption. The issue is that most users rely on short PINs or<br>
a visual unlock pattern, which does not provide enough randomness to<br>
ensure security of their data. In addition, due to the use of a<br>
touchscreen, fingerprint oil smudges on the screen often reveal the<br>
numbers entered or the pattern drawn to unlock the device (See the<br>
“Smudge Attacks on Smartphone Touch Screens” paper.)<br>
<br>
More here:<br>
<a href="https://guardianproject.info/2012/01/04/strong-mobile-passwords-with-yubikey-usb-token/" target="_blank">https://guardianproject.info/2012/01/04/strong-mobile-passwords-with-yubikey-usb-token/</a><br>
</blockquote></div><br></div>
</div></blockquote></div></div></div></blockquote></div><br></div>