In the wildHF · 13.56 MHz
Security keys (YubiKey)
The thing on your keychain that logs you in with a tap — a smart card in a different shape.
A YubiKey 5 NFC (and many other FIDO security keys) plugs in over USB and works as an ISO 14443-A contactless card. Tap it on the back of a phone and the phone sees a smart card running several applets at once.
#What's inside
- FIDO2 / WebAuthn (and the older U2F): passkey-style login. The key makes a separate key pair for each website, and signs a challenge that includes the site's real address. A lookalike phishing site gets a signature that's useless on the real site.
- PIV and CAC: the US government smart-card standard, used for computer login, SSH keys, code signing and the like.
- OpenPGP: keys for signing and encrypting email or git commits.
- OATH: TOTP and HOTP codes, with an authenticator app reading them over NFC.
- Yubico OTP: a one-time password. Over NFC it shows up as an NDEF URL, which is why tapping a YubiKey on a phone can pop open a web page.
All of these are public-key or shared-secret applets on one chip. None of them let you read the private keys back out.
With Your phone
Use the key to log in to a site that supports passkeys or security keys: when the browser asks, tap the key on the back of the phone. The Yubico Authenticator app reads OATH codes over NFC.
With USB NFC reader
Yubico's ykman can talk to a key through a PC/SC NFC reader with its
--reader option. Try ykman --reader <name> info on your own key.