My very first Perl Module has been published on CPAN, and I’m happy to announce that the Yubikey_Decrypter module is available for download!  It requires the Crypt::Rijndael module.  Please note - this is not the authentication server - this is just the module required to decrypt the AES token to it’s basic components.

My module’s link has also been published on Yubico’s website - I’m very happy about that !!

Then, I found a neat Wordpress plugin for the Yubikey.  The only downside to it is you need to register an API key for every Yubikey user on your blog, which is making it a little un-userfriendly.  I tried to post a comment on the author’s blog, but everything is in Danish, making it difficult to post some feedback.  Ideally the API key side of things should be moved to a Manage page.

I’m liking this key more and more every day!

Anything related to podcasting that you’d like me to cover, let me know and I’ll throw it in.

Cheers!

The Yubikey is a hardware device.  It’s a paperthin USB “dongle”, with a single button on it.  When you plug the Yubikey into your PC, your machine will recognise it as a keyboard.  That’s right.  The Yubikey looks like a keyboard to your computer.  When you press the button on the Yubikey, a one time password gets generated, the one I have on my computer at the moment, has this nice big long password.

tflgdfcdrlilitebcrhgkrkricjklrfifvltfhublbnv

Ok, that looks like junk, but there’s logic behind it.  Here goes…

First of all, you’ll notice that the token generated by the Yubikey is not hexadecimal or anything like that, no, it’s what the folks at Yubico refer to as modhex, it’s a way of represending hex with a character set that is available on all keyboard.  It’s not very difficult to decrypt it back to it’s regular hex equivalent.

Next up, the token is then decrypted with a strong secure AES (Rijndael) encryption.  The decrypted blob contains some values, which are

• A unique number for each Yubikey
• The number of times the key has been powred up
• The number of times the button has been pressed since power up
• A timer that increments at 8Hz after the first press
• A random seed
• A CRC checksum

Using all of these values together a proper authentication mechanism can be built.

So why would you order one of these??  Well, here’s the thing…  In my opinion, these devices are very cool, they’re cheap, very secure, and even open source (if you can call it that), however, the problem is there is very little adoption.

As an enterprise, you could order a few thousand of these for distribution to your employees, suppliers, vendors, etc. and by modifying your existing intranet or extranet application, you can have Yubikey strength authentication in minutes — I’m serious… By utilizing the Yubico backend, your Yubikeys can authenticate to the Yubico backend without a problem.

Currently Yubico manages all the AES keys in their own data center, hence the reason when you authenticate to their backend, you don’t see the AES key, you just pass them the OTP, and their authentication service will give you a Yes or No response (of course it’s a little more complicated than that, so head on over to the Developer site for more info).  This in itself isn’t a problem, since Yubico manages that for us, however, as we know, for highly secure environments, we may want to take control of that.

Yubico offers an SDK you could use to develop your own authentication service.  Using my own code, I’m almost finished with my own Yubikey authentication service, that could be utilized inside a corporate environment.  The problem now comes with key management.

When my Yubikeys arrived in the mail, I did not receive the AES keys, so testing my authentication and decryption code was tricky.  After I emailed Yubico, they were kind enough to forward me my AES keys.  When running your own authentication service, you will need to have access to all the AES keys for the Yubikeys you’re authenticating.  Without it, the only alternative would be to seed the AES keys manually using the Yubico Personalization tool.  Be careful though - if you nuke the AES key on your Yubikey, you will break the link the Yubikey currently has with the Yubico backend.  This is not necessarily a problem.  If you’re distributing the keys inside your organization and you want to manage your keys yourself, this might be an option, be aware though that this will result in a user potentially carrying multiple Yubikeys for internal and external sites.

The only risk I can see, would be with running your own authentication server.  Managing the keys would be a tedious process.  If you then choose to use the Yubico supplied keys, it’s would be important to have some proxying effect happening back to Yubico as well.  By not doing this, the Yubico server and your internal server would be at different stages of authentication.  For example, one of the counters the Yubikey returns in the OTP, is the number of times the key has been powered up.  This is an incremental counter.  If for some reason the user uses his Yubikey on an Internet site, and a disgruntled collegue captures the OTP used on the internet site, he could then use the captured OTP on the intranet site, and gain access to privileged information.  If you have to run your own server, find a way to manage the keys yourself.

“Out of the box”, Yubico offers an OpenID service, which is starting to gain some adoption in the industry, but not much yet.  So if OpenID is useful to you, securing it with a Yubikey is a great way to accomplish this.  Yubico has a PAM module available, allowing your Unix-type machine to authenticate to Yubico, and there are plans to build a GINA for Windows so you can log onto Windows with it.  The only risk (again) is local authentication without a link to the server is risky, as I explained earlier in the post.

So that’s it folks.  I’ve submitted my CPAN module today, so hopefully we’ll see it up there soon, and you’ll be able to decrypt the Yubikey OTP through Perl like a pro!  Next up, I’ll publish the server code using the decrypter module.

The code is not made into a perl module yet, this is still on the todo list (if you have experience with making perl modules, kindly contact me!) .  It has a dependency on the Crypt::Rijndael module, so be sure to have it installed.

There is a catch.. To use this procedure, you will need to have the AES key for your Yubikey.  There are two ways to obtain it.

1) Email Yubico and ask them to send you the AES key.  You will need to provide the OTP (one time password) from your Yubikey before they can release it.

2) Reset the AES key.  Using the developer tool from the Yubico website, you can reset the AES key to anything you want.  Be careful though - if you zap your AES key, you will not be able to use the Yubikey on Yubico’s systems, thus the openid and forums etc will be inaccessable.

Watch this space.. I’m almost finished with my own Yubikey authentication server all in perl, using a mySQL database backend, as well as this exact same module for the heavy lifting.

File info:
Type: image jpg
Size: 56.16 kb
How to drink a milkshake

So Jarod made it home, he slept most of the day, had his first bath at home, Marissa is really enjoying having her brother at home.

It’s good to have Hester and Jarod at home.  The next few days are going to be busy and a big adjustment for all.  We haven’t had a little person at home for a while.

File info:
Type: image jpg
Size: 35.24 kb
Look at me sleeping…

File info:
Type: image jpg
Size: 48.82 kb
Jarod Thomas Massyn

We’re on our way to the hospital… As you can see, Hester is about to explode!  In a few hours time, our little baby boy will be here…  I’ll post a pic from my phone if the technology allows it.  So far so good.

The house is getting excited.. My mom is the designated baby sitter (looking after Marissa)…  Ok, time to shut down, and get to the hospital… Watch this space for more baby updates.

We saw the doctor today (yesterday — sorry!  It’s after midnight!!) and everything is looking great.  Little Baby Massyn is healthy, strong heartbeat, mom is doing good, so yeah, not a big update in my life, but at least an update…

It’s all systems go !

So today (Wednesday) the agenda will include going to the gym, taking the kids to school, relaxing with Hester and my mother at home, maybe watch a movie or something… We’ll see what the day holds…

Watch this space…. The next post may include a photo soon after delivery… Any idea why I’ve been testing blogging from my mobile phone lately??  I can post a photo from my phone, directly to my blog, onto Twitter, and onto Facebook… It’s a schweet setup!

If you’re keen to get the updates, subscribe to the RSS feed….

File info:
Type: image jpg
Size: 53.33 kb
Mobile photo blog

Yesterday we had another scare…  Yeah, Hester had very high blood pressure, we rushed to the hospital, thinking this is it, and when we got there the pressure was off… All good - nothing is wrong, the baby is still healthy, but no labor pains, just continuous discomfort for my poor wife… Hehe!!

We will be seeing more doctors this week, and if all goes well, Thursday will be the day that Baby Massyn will make his appearance.  Watch this space…  I’ll be trying to post some pictures from the hospital, so it will be a test of mobile technology, GPRS and mobile blogging with a fancy new mobile plugin I found for Wordpress.

I must say - I’m getting excited now!!

My new toy, the Zoom H2 flash recorder, with some sample recordings from Castle Towers and Dayspring Church.

Na my trippie in India, hier is wat gebeur het…

It’s my last day in Chennai, India. I can’t believe it’s been two weeks already.

Man it’s hot! I think we’re currently about 2 degrees above the equator, so the temprature is about 42 degrees celcius, and very humid.

Ok, my first thoughts - the traffic is chaos - organized chaos! The rule is the driver on the motorbike should wear a helmet, but the passenger(s) don’t have to, so I found it quite hillarious that one driver had 3 kids on his motorbike! That would never work in Australia!

When you first see the culture, you’d think it’s very poor, with very bad conditions, and in a lot of cases, that is true, but when you spend some time with the Indians, you realize that they have a lot to offer. The hotel we stayed at had excellent service. I think the 1st world countries could learn a thing or two about customer service from these guys! They are a humble people, who like spicey food, and man, I love the spiceyness!

Getting back to the “poorness”, the amazing thing is the company we’re at now, is in an area that is being developed. As you probably know, a lot of companies are now outsourcing a lot of their services to India, and you can see it’s really boosting the economy. Here are more buildings being built, roads being built, more infrastructure put in place, more people getting jobs, thus more money being pumped into the economy.

I must say I have really enjoyed my trip here in India, and I look forward getting back to Sydney.

Here’s the even cooler bit. Yubico has released some C & Java code for coding your own backend system. The kind folks at Yubico is helping me understand the protocol so that I can help you bring a perl version of the backend server.

Yubico also offers an OpenID server. Even though it’s a paper thin little USB device, it’s got the ability to secure your digital life. I’m looking forward to getting mine in the mail, and start playing around with some code to interface with this little thing. Watch this space… I’ll be giving you a good overview to how the device goes through. I’ve already had a think about some potential “security issues” that may exist, so I’m very excited to see the little device, and put it through it’s paces.

You may be familiar with RSA’s SecureID.  There’s a few differences between them.  First of, SecureID displays a 6 digit number that has to be entered manually.  This is handy for PCs that do not have USB port, or older type PCs that just don’t support the specific USB Keyboard emulation that Yubikey gives you.  The big downside to SecureID is the cost.  It’s only big corporates that can afford it.   I’d love to get my hands on a SecureID token and write code for it - the chances of that happening is very slim.   With the Yubikey I’d be able to write my own code to interface with it.

Well, being a perl coder on the Unix platform mainly (and considering that perl is fairly cross platform), I used my encoder and uploader script on Vista…. Hmm…. The encoder script (pumping through lame) wasn’t a big deal. Sure I had to deal with the common / vs \ issues, etc, but nothing funny there. The upload script had a little snag. I use the curl utility to perform my upload, mainly because it’s cool, and because it supports resume on upload (ok, no, it doesn’t really, but with a loop in the script I can do it). For some crazy bizarre reason though, curl can not connect to my hosting provider. This is very strange… I have connectivity, I can ftp into my hosting account through DOS and FileZilla, but curl is a no go.

Strange one… I think I’ll test the same version of curl on an XP box, just to confirm it’s not a Vista problem.

Ok, ok… Let me come out and say it… Vista is not too bad…. There - I said it… It’s an ok consumer OS. At least my Rode Podcaster microphone is working now (did I tell you ??) yeah, it seems that www.rodepodcaster.com says it’s not supported, but rodemic.com has a firmware upgrade for it… Go figure! podify.net #009 was recorded with the Rode Podcaster within Adobe Audition 2.0 on my (wait for it!) Windows Vista powered Dell Lattitude 1525 laptop.

Time to go to bed… Cheers

Let’s talk about advertising in your podcast.

“Phil running vista?? That can’t be right??” - well, no, I would have preferred Linux, but let’s face it, although Linux is a very slick OS, for development I would prefer to work on Windows. Make no mistake, the first app I installed was VMWare, I pulled my Ubuntu development VM onto it immediatly.

The first thing I noticed about Vista, was that it’s different. Yeah yeah, ok, so I’m the old school guy who’s not used to the interface, but honestly, I felt like a fish out of water. Vista is different. The first thing I noticed was the performance… I would have expected this new laptop to churn through it, but Vista is slow. It took forever to bootup.

Apart from the slow performance, it worked reasonably well. After using Vista for a few days, I got more familiar with it, disabled the dodgy UAC (man it’s annoying to have to acknowledge every thing every couple of minutes!!).

So today I was setting up my desk, putting the laptop in it’s rightful place, hooked up my Rode Podcaster mic, and noticed vista complaining that the Rode did not install correctly. I head on over to Rode’s website, and found out with horror : The Rode Podcaster is not supported on Vista yet. (UPDATE - I found Vista firmware for the Rode over at rodemic.com - but now it’s gone (??) - at least I managed to upgrade my Rode, and it’s working now)

Come on! I just paid over a $1000 AUD for this laptop, the mic was about $250 AUD, and now I can’t use it? That’s it…. Let’s load XP…

You think that’s easy ?? Ha, Dell was so kind as to NOT include any XP drivers with the laptop. I also couldn’t boot up with my XP CD, because the laptop can not see the SATA disk. So I got nlite, and packaged my own custom XP version with the SATA driver in it. After a couple of hours of installation, I am now writing this blog entry on the same Vista-only machine, running Windows XP.

What is amazing though, is that Dell never gave me the option to choose XP. In hindsight, I probably should have chosen the 1520 (which does have an XP option). Fortunately the 1520 and the 1525 have similar chip sets, so I’m downloading the additional drivers for the 1520, and hopefully I can get my dual monitor working again properly. (UPDATE - Oh dear - I’m back on Vista.  It seems that the 1520 is NOT compatible with the 1525. Even though I managed to get XP running, the drivers were a mess)

So guys, when buying a Dell, be carefull.. Vista is not as cool as it seems. If you don’t need it, don’t buy it. It is slow - I don’t care what anyone says. This dual core laptop is now screamingly fast. And my Rode Podcaster mic is working nicely.

Come on Dell — don’t let Microsoft bully you into loading Vista only…