10.6 Interoperability for Yubico smart cards

This section contains information about any considerations for using these smart card with other systems.

10.6.1 Unlocking YubiKey tokens

YubiKey tokens include a PIV applet, which means that you can use the MyID Card Utility to carry out a remote challenge/response unlock operation and change the user PIN, and the unlock credential provider to unlock the devices from the Windows logon screen.

See section 2.13, Unlocking smart cards that have a PIV applet.

10.6.2 PIN policy settings

MyID allows you to set various policies for PINs using the settings in the credential profile. MyID enforces these settings for any operations carried out by MyID. For some smart cards, some or all of these settings are applied directly to the card, which means that the settings will also be enforced by third-party tools and utilities.

The following settings are supported for on-card PIN policy settings:

 

Smart card

PIN Setting

YubiKey 4

YubiKey 5

YubiKey FIPS

Maximum PIN Length

 

 

 

Minimum PIN Length

 

 

 

Repeated Characters Allowed

 

 

 

Sequential Characters Allowed

 

 

 

Logon Attempts

Y

Y

Y

PIN Inactivity Timer

 

 

 

PIN History

 

 

 

Lowercase PIN Characters

 

 

 

Uppercase PIN Characters

 

 

 

Numeric PIN Characters

 

 

 

Symbol PIN Characters

 

 

 

Lifetime

 

 

 

MyID also supports the following YubiKey-specific settings by creating a customized card data model file:

The following settings are supported:

 

Smart card

PIN Setting

YubiKey 4

YubiKey 5

YubiKey FIPS

PUK Retries

Y

Y

Y

Per Container PIN Policy

Y

Y

Cannot set to "never"

Per Container Touch-to-Sign Policy

Y

Y

Y

Touch OTP

Y

Always on; cannot configure.

Y

You can configure the on-device settings by editing the card format file; these settings are applied when you issue, reprovision, or update the YubiKey token.

The Yubikey.xml card format file is located on the MyID application server in the following default folder:

C:\Program Files (x86)\Intercede\MyID\Components\CardServer\CardFormats\

Important: Do not edit the base Yubikey.xml file, as it may be overwritten by subsequent MyID updates or upgrades – instead, make a copy of the file in the same folder and give it a name that you can use to identify its purpose; for example, if you create a file to change the number of PUK retries to 5, you may want to name the copied file Yubikey_5_PUK_retries.xml.

To select the card format file, in the Credential Profiles workflow, in the Device Profiles section, from the Card Format drop down list select the copy of the Yubikey.xml file you created; for example, Yubikey_5_PUK_retries.xml.

You can configure the YubiKey on-device settings as follows:

Warning: Do not amend any other parts of the card format file. Incorrect configuration may lead to failure to issue a token.

Updating existing YubiKey tokens

You can update existing issued YubiKey tokens to use the on-device settings; you can request a card update through MyID, or you can use the Lifecycle API.

When deciding whether to update your existing YubiKey tokens, consider the following:

To update an existing YubiKey:

  1. Use the Request Card Update workflow to request an update.

    For more details about using this workflow and how it affects your credentials, see the Requesting a card update section in the Operator's Guide.

  2. Select one of the following options:

    • Request a resync of the card to the same version of the current profile – select this option if you have made no changes to the credential profile used to issue the token.
    • Request an upgrade of the card to the latest version of the current profile – select this option if you have made changes to the credential profile used to issue the token.

    • Request an upgrade of the card to the latest version of the following profile – select this option if you have created a new credential profile to use for the on-device PIN policy settings.

  3. Select the appropriate reason.

    • To carry out a reprovision, replacing all of the certificates on the token, select the There is a problem with the device reason.

    • To carry out an update, which affects only the Per Container PIN Policy or Per Container Touch-to-Sign Policy, and only for certificates that are required to be added because of the update, select the New certificates need to be added to the device reason.

  4. Collect the update using the Self-Service App.

For systems with a large user population, you may prefer to create update requests using the Lifecycle API. The relevant section of the submission for generating a card update request is shown below.

For carrying out a full reprovision using the CMSCardRequest schema:

<Card>
 <CardProfile>Yubikey NoOTP</CardProfile>
 <CardRequestedBy>System</CardRequestedBy>
 <OriginalSerialNumber>8115516</OriginalSerialNumber>
 <OriginalDeviceType>YubiKey 4</OriginalDeviceType>
 <StatusMapping>84</StatusMapping>
 <Reprovision>1</Reprovision>
</Card>

For carrying out an update:

<Card>
<CardProfile>Yubikey NoOTP</CardProfile>
<CardRequestedBy>System</CardRequestedBy>
<Update>
 <OriginalSerialNumber>8115516</OriginalSerialNumber>
 <OriginalDeviceType>YubiKey 4</OriginalDeviceType>
 <StatusMapping>86</StatusMapping>
</Update>
</Card>

Replace the values of the nodes in the example above with values corresponding to the user population in your system.

For more information on the Lifecycle API, see the Lifecycle API document.

Using YubiKey tokens for Windows logon

If you want to use your YubiKey tokens for Windows logon, you must set the Per Container Touch-to-Sign Policy to 03 (cached) and Per Contain PIN Policy to 02 (once).

10.6.3 Unsupported functionality

MyID supports the "Smart Card (PIV-Compatible)" interface for Yubico devices. MyID does not enable or modify the following Yubico features:

10.6.4 Unlocking

MyID typically sets a randomized personal unlocking key (PUK) when it issues a Yubico smart card. This PUK is not available to any system other than MyID. If you want to unlock a Yubico smart card, you must use MyID (for example, the Self-Service App, MyID Desktop, or the MyID Card Utility).

For information on the MyID Card Utility, see the Remote PIN Management utility for PIV cards section in the Operator's Guide.

10.6.5 PIN attempts

The number of attempts to enter a PIN for a Yubico device is set by the manufacturer, but MyID can override this using the Logon Attempts option on the credential profile.

10.6.6 PIN characters for PIV cards

The SP800-73 PIV specification requires that PIV cards use numeric-only PINs. It is possible to configure MyID to use non-numeric PIN characters for PIV cards, although the smart cards will fail to issue.

Make sure you set up the credential profile correctly; in the PIN Characters section of the Credential Profiles workflow, set number to be Mandatory, and uppercase letters, lowercase letters, and symbols to Not Allowed.

10.6.7 Additional identities and PIV cards

You cannot use the additional identities feature of MyID with any smart card that has a PIV applet. This includes all YubiKey tokens.

10.6.8 Identification of YubiKey 4 and YubiKey FIPS

YubiKey 4 and YubiKey FIPS devices share an ATR value, and can be differentiated only by their firmware version.

If a YubiKey device has the following ATR:

MyID identifies the device based on the firmware as follows:

10.6.9 Known issues