Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi...
by nmikhailov on Friday May 13, 2016 @01:19PM
(#11691711)
> No, it's the code for the new YubiKey 4, which has been closed off.
yk4 firmware was never released; that particular issue is about NEO's openpgp applet.
>Ideally, you can build and flash the firmware yourself.
You couldn't do that with NEO(except from early dev version) as global platfrom management keys are unknown, which makes it impossible to delete/upload applets. I actually tried to get dev. version but they redirected me to NXP who never answered.
Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi...
by evanosaurus on Friday May 13, 2016 @04:40PM
(#11693093)
You can't flash the firmware yourself, as the keys are discarded as soon as they're generated per device.
What you could do, however, is read the bits off of the firmware and make sure they're identical to the bits you make from source. Reproducible builds, and all that.
Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi...
by geofft on Friday May 13, 2016 @01:17PM
(#11691706)
Oops, that was unclear. What I meant was closer to "This is about a specific piece of functionality that, in the past, was an open-source sandboxed plugin on the YubiKey NEO, running inside the main NEO codebase, which was proprietary?"
Could you have flashed the proprietary part of the NEO codebase yourself, or just the plugin?
No, it's the code for the new YubiKey 4, which has been closed off.
> What guarantee do you have that the code on the device matches the code on GitHub
Ideally, you can build and flash the firmware yourself.