About Windows AAD offline login using hmac-secret

[Steven li]

Hi guys,

I have a questions to ask

1. Regarding hmac-secret, I found that Yubico provides a Windows login application that can also log in offline, and join Windows AAD with USB FIDO Key. 

Do they all use the HMAC Secret extension?

Yubico Login for Windows Configuration Guide link:

https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide

2. Or where to find an intuitive application of the HMAC secret extension?

Thanks,

Steven

[My1]

I think the Windows AAD thing uses hmac-secret (notably to likely provide secrets for decrypting stuff), and while the Windows Login application of Yubico does use HMAC, it does not use hmac-secret specifically, or in fact it does not use anything FIDO, but rather the hmac function Yubikeys specifically provide, which is also a reason, the Blue Yubis and the Bio wont work with the Yubico Application, as they are pure FIDO keys.

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/b98b2b02-852e-4bcf-b31a-b2de9db538f5n%40fidoalliance.org.

[Steven li]

Hi My1,

Thank you for your prompt reply.

I will look again to see if there is any application of hmac-secret extension.

Steven

My1 在 2023年1月3日 星期二上午10:36:58 [UTC+8] 的信中寫道：

[Emanuele Cesena]

To the best of my knowledge Windows login (the enterprise login via AD) does use hmac-secret. It’s very possible that Windows also has a specific integration with yubikeys as My1 describes, but if you use for example a solokey that’s going to use hmac-secret extension.

So, if you’re looking for an example of hmac-secret used in a real application: windows “enterprise login" with a solokey/FIDO key.

Best,

-- 
Emanuele Cesena
0x0ece.com

Il corpo non ha ideali

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/5c37a8fd-111e-4724-9e4a-69504d148453n%40fidoalliance.org.

[My1]

not quite.

The question revolves around both FIDO and the Yubico Login for Windows Application, so it may be a bit confusing to read.

https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide

that application uses the Yubikey's specific HMAC Profiles for login, while on the other hand AAD uses hmac-secret and actual fido.

Regards