Re:OnlyKey: Open-Source Alternative to YubiKey
by zzziizzz on Friday December 27, 2019 @08:12AM
(#21891121)
I don't know which SE you're talking about, but the ones I've worked with are pretty secure, for one, side channel attacks are extremely difficult
[ Parent
| on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey
by RL_Quine on Friday December 27, 2019 @01:59PM
(#21893457)
I believe this is mostly down to the obscurity of them rather than good implementation. The implementations of ECDSA predominantly are almost always not constant time, which directly leaks the size of the nonce that has been chosen. That none of them implement RFC6979 deterministic nonces is a very good indication that they have put zero care into their implementation.