5

I found the following Github Repo that makes it possible to build your own Yubikey with an Arduino Leonardo device.

https://github.com/pagong/arduino-yksim

Pretty cool. However I am wondering if using this is legal at all?

YubiCo is a company and they sell sticks with the YubiKey OTP feature. The verification process happens through their servers. Somehow I can't quite imagine that the company YubiCo tolerates that their processes and products could be easily replaced by open source products? Maybe they have any patents or utility models? And I was not able to find any licensing information which makes sense since official firmware seems to be closed source. So I guess it makes sense that no licensing information is available since the yksim project is a reverse engineered thing?! But I'll admit quite frankly: I have no idea of all this.

I would also like to use this library and possibly also for my customer projects, but I need to know whether this is really allowed.

Hope someone can help me here and I know that the internet is no source for a 100% sure legal advice. But maybe someone has a clue or a hint for me.

Edit 1:

I learned the the library it based on an Open Source lib that was published by Yubico itself. https://github.com/Yubico/yubico-c

4
  • 4
    Have you looked at Wikipedia? There you can see which technologies and protocols are used by Yubikey. It all seems to be open standards. May 4, 2022 at 7:15
  • Yes, you are right. Thank you. I just learned that even the Arduino lib is based on an other lib that was published from Yubico itself.
    – fpdragon
    May 4, 2022 at 19:43
  • Does the verification process really happen through their servers?
    – user253751
    May 17, 2022 at 11:59
  • @user253751 in certain of the supported operating modes, yes, it does, but not in many others.
    – MadHatter
    Jun 19, 2022 at 5:34

1 Answer 1

4

IANAL so I obviously can't give you a legal answer, but this sort of thing would seem to fall under reverse engineering.

If it's possible to observe the behavior of a product and then copy that behavior simply from the observations alone, it'd be pretty hard (but definitely not impossible - well-funded lawyers have plenty of ways to make someone's life hell) to argue that you are doing anything wrong. This is exactly why we have the PC market today - we can thank Compaq for their reverse engineering efforts on the IBM PC and their legal win regarding the practice, which basically set the stage for the entire modern PC industry.

Now, if your product depends on the original product - i.e. if you are accessing the servers to duplicate the functionality - you might have a licensing issue, because it's likely the original product's license probably included language about when and how you may access the servers. (In the Compaq case, it might be compared to designing a clone PC and then installing legitimately acquired IBM ROM chips - definitely less illegal than blatant copyright infringement, but there could still be a license preventing the ROM from being used outside a genuine IBM PC system, similar to how it's against the license to install macOS on a Hackintosh PC.)

If someone had developed a Yubikey clone that was 100% interoperable and indistinguishable from Yubikey (i.e. it "just worked" with anything designed for Yubikey authentication) and sold it commercially I doubt that entity could get away with it.

There's plenty of examples of open-source libraries that copy functionality from commercial products that "get away with it" simply on the basis that it's pretty difficult to strike down an open-source project in its entirety, but that also doesn't make it "legal". There's also the issue of jurisdiction - just because a piece of code is illegal in one place doesn't make it illegal everywhere. A good example is the DeCSS code - it's open source, but there's plenty of legal issues surrounding its use, to the point where most popular Linux distros require you to jump through a couple hoops to get it installed, and without it you can't even play a DVD on Linux.

As for Yubikey, as others have suggested it looks like it's largely built on open standards, so writing code to simulate a Yubikey is likely already easy to do in the first place. I'd imagine the biggest issue would be if that code accesses their servers in some way that is against an acceptable use policy, but even then that's just a risk you choose whether you want to take or not - even an AUP (or parts of it) could be deemed unenforceable or unlawful, but until it's challenged you wouldn't know. Plenty of very popular projects (e.g. Youtube-DL/yt-dlp) access servers in a manner against the AUP, and it's up to the server host to enforce the AUP, but even lack of enforcement does not imply legality.

Ultimately it's up to you to decide if using some code or some project is OK with you. If you're in a position where legal issues are an actual concern, the only way to deal with it is to consult with a lawyer who specializes in these sorts of things.

4
  • I'm not sure any server of them needs accessing in order to make use of the yubikeys. Afaik that's the point to not need it May 4, 2022 at 15:04
  • @planetmaker: Not sure about this. AFAIK the yubico servers are the only ones that are able to VALIDATE Yubikey OTPs.
    – fpdragon
    May 4, 2022 at 19:37
  • This answer relies on the (wrong) assumption that it needs reverse engineering to come up with the functionality. Instead we have to acknowledge that there are open standards which everyone can read to implement a solution. And b.t.w., in case of a patented technology reverse engineering would also be improper/illegal. I would like to add a word of caution: It requires a lot of experience to properly implement security functions in software and hardware and a naive implementation might do more harm than good. May 5, 2022 at 6:30
  • @fpdragon see above; in certain operational modes, the data the key provides are validated off yubikey's servers, but in many others they are not. It depends on how you have the yubikey set up.
    – MadHatter
    Jun 20, 2022 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.