Using Yubikey with Vanadium

sirfartsalot

Can someone help me use a YubiKey with GrapheneOS? I used other posts on this forum as a guide, but I can't figure it out. I tried:

Create a new profile (for a repeatable starting configuration for debugging purposes).
Settings > Multiple users > Add user > OK. Then walk through new user creation.
As the new user, download Google Play services and Google Services Framework.
Apps > Install Google Play services and Google Services Framework.
Enable storage scopes on Google Play services
Settings > All Apps > Google Play services > Permissions > Photos and videos > Configure Storage Scopes > Enable
Ensure NFC is enabled
Settings > Connected Devices > Connection Preferences > NFC > Enable
Test 2FA at demo.yubico.com/playground
Open Vanadium > Go to webpage https://demo.yubico.com/playground > Create new account > Add security key > Next.
At this point, I should interact with my YubiKey via NFC or by plugging it in. Instead, it shows the error message "Operation cancelled" and "There was an error in the registration procedure, please try again".

matchboxbananasynergy

sirfartsalot Hi there!

I noticed you didn't install Google Play Store. Even if you don't plan to use it, please install it. It's required for Sandboxed Google Play to work properly.

BeefCake

sirfartsalot I'm not sure if the following will solve your issue, but thought I'd share anyway as I went down a rabbit hole a while ago trying to get my YubiKey to work (via NFC) with the KeePassDX (password manager) mobile app. On my GrapheneOS device I do not have Google Play services installed and it works like a charm...

I managed to find this project:
https://gitlab.com/kunzisoft/android-hardware-key-driver

Project description:

Key Driver is a driver application for hardware keys (SoloKey and Yubikey) that provides an answer to a challenge for applications requiring physical key authentication.
The application allows to use :

The hmac-secret FIDO2 functionnality of SoloKey.

The HMAC-SHA1 challenge-response functionality of Yubikey with USB OTG or NFC connection.

The Key Driver app is available on Google Play, or via direct APK downloaded from GitLab:
https://gitlab.com/kunzisoft/android-hardware-key-driver/-/releases
Direct download:
https://gitlab.com/kunzisoft/android-hardware-key-driver/-/jobs/6788429195/artifacts/file/app/build/outputs/apk/debug/app-debug.apk

Note: the APK downloaded from GitLab has the file name app-debug.apk but it is actually not a debug build (which is good!), and I believe it was named this way because of the fixes pushed in this version by the developer ("Fix debug mode for gitlab package")

The Key Driver app does not require any permissions (and doesn't even request them), which is also great!

Give it a try, and I hope this help!

sirfartsalot

matchboxbananasynergy

That fixed it, thank you! A full list of correct steps is below:

Create a new profile (for a repeatable starting configuration for debugging purposes).
Settings > Multiple users > Add user > OK. Then walk through new user creation.
As the new user, download Google Play services, Google Services Framework, and Google Play Store.
Apps > Install Google Play services, Google Services Framework, and Google Play Store. All 3 are required.
Enable storage scopes on Google Play services
Settings > All Apps > Google Play services > Permissions > Photos and videos > Configure Storage Scopes > Enable
(Optional) For privacy, disable sensors and network permissions for all 3 Google apps.
Settings > All Apps > Google Play services > Permissions > Network > Don't allow. Sensors > Don't allow.
Ensure NFC is enabled
Settings > Connected Devices > Connection Preferences > NFC > Enable
Test 2FA at demo.yubico.com/playground
Open Vanadium > Go to webpage https://demo.yubico.com/playground > Create new account > Add security key > Next. Interact with my YubiKey via NFC or via USB. Both NFC and USB were tested and work properly with a YubiKey 5C NFC.

matchboxbananasynergy

sirfartsalot Glad it worked out. :)

chock-a-block

sirfartsalot

Once you set this up, does the yubikey work outside of the new profile or does all your FIDO2 yubikey-authenticated accounts have to be accessed within that profile?

matchboxbananasynergy

chock-a-block I'm pretty sure it only applies to the profile in which Sandboxed Google Play is isntalled. The Sandboxed Google Play installation doesn't persist across profiles, they can't even see apps in other profiles cause they're just regular apps.

sirfartsalot

matchboxbananasynergy
That is correct. In my instructions, the first step of "create a new profile" was only to provide a consistent baseline for testing purposes. Set it up on the profile that you want to use hardware key 2FA with.

FreshStart

Is there any way to get a Yubikey working on GOS without installing Google Play Services / Framework / Store, etc.?

treequell

FreshStart It's FIDO that requires Google Play Services.

FreshStart

There's no open-source app that provides the same service?

treequell

FreshStart Not currently, no

FreshStart

treequell Thank you :-)

crafte

Even on windows, its not that easy

fid02

ksatravelspk I'm not usually one to brag, but I dare say that my security key guide is more helpful than what the AI you used spat out: https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90

DeletedUser64

Been using yubikey on GrapheneOS for over a year without any G##gle stuff installed. I only use the yubikey for OTP via Yubioath and it works as it should. I use it as challenge response with keepassxc and it works as it should. I have never used the yubikey via vanadium.

fid02

DeletedUser64 Although this thread is referring to FIDO functionality. OTP features are not related to that.

DeletedUser64

fid02
That's what I said but using different words...

This thread gives an impression that Yubikey works only on GrapheneOS with G@@gle services installed, which is not the case, depending upon what you use the yubikey for.

viket

It looks like NFC might not be functioning as expected—try using the USB connection to the YubiKey instead, or check your NFC settings and YubiKey firmware. If issues persist, checking logs with adb logcat could provide more insight.