<p>As answered in <a href="https://bitcoin.stackexchange.com/q/29702/1137">a newer, strongly related question</a>: You can now get the leaked keys from <a href="https://bitcointalk.org/index.php?topic=631044.0" rel="nofollow noreferrer">https://bitcointalk.org/index.php?topic=631044.0</a></p>

CC BY-SA 3.0
2016-11-26T19:14:06.377Z
2016-11-26T19:14:06.377Z
2017-04-13T12:47:33.583Z
Tobias Kienzler
<p>Mt. Gox locks their Yubikeys with an access code. You cannot reprogram them without the code. If you're willing to wait a few months, you can <a href="https://github.com/nezza/yubicrack" rel="nofollow">brute force</a> it.</p>

CC BY-SA 3.0
2013-06-25T06:28:37.513Z
And they wouldn't release the access code because it would render the Yubikey useless with Mt. Gox? Why did they opt to make their Yubikeys exclusive for Mt. Gox?
Geremia
CC BY-SA 3.0
2013-06-25T13:19:29.060Z
@Geremia: Doing it this way eliminates [a number of potential vulnerabilities](http://bitcoin.stackexchange.com/a/7171/85).
David Schwartz
CC BY-SA 3.0
2014-07-25T16:36:07.453Z
Do you know if Mt. Gox would release or has released the access code, now that they're belly-up? If so, we could reprogram the YubiKeys they sent us with a different access code and use them for other purposes. The YubiKey they sent me is just collecting dust…
Geremia
CC BY-SA 3.0
2013-06-23T04:09:21.543Z
2013-06-23T04:09:21.543Z
David Schwartz
<p>After following <a href="http://forum.yubico.com/files/VIPunlockGuide.pdf" rel="nofollow">the instructions here</a>, which suggested I use <a href="http://yubico.github.io/yubikey-personalization/" rel="nofollow"><code>ykpers</code></a> or the <a href="http://yubico.github.io/yubikey-personalization-gui/" rel="nofollow">gui version</a>, I discovered the Mt. Gox Yubikey is protected by a "configuration protection access code."</p>

<p>From <a href="http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf" rel="nofollow">the manual</a>:</p>

<blockquote>
  <p><strong>Protection of the key and configuration data</strong></p>
  
  <p>Given the symmetric nature of the AES encryption algorithm, the
  security of the Yubikey relies that the AES key is logically and
  physically protected both in the key and in the server that verifies
  the OTP.</p>
  
  <p>The configuration data is updated via a configuration API, accessible
  via the USB interface. To prevent unauthorized update, the
  configuration can be protected by a 48-bit access code. If used, an
  exhaustive search of all combinations would typically take some
  100,000 years to perform. Furthermore, the Yubikey configuration data
  is write-only, i.e. configuration data and the key can only be written
  but not be read. This means that unauthorized update of the
  configuration is an act of sabotage rather than a security threat.</p>
  
  <p>The configuration data is stored in a non-volatile storage integral to
  the microcontroller. A potential attack is to physically probe the
  silicon or analyze the hardware behavior to potentially gain full or
  partial knowledge of the stored secrets. However, such an attack would
  require a complete break-up of the Yubikey, involving dissolving the
  microcontroller chip encapsulation. Furthermore, very advanced
  equipment is needed to probe the chip internals. Given the effort and
  costs involved for such an attack, this is not considered a threat
  given that just a single device will be broken.</p>
</blockquote>

<p>Yubikey wrote me:</p>

<blockquote>
  <p>In case, if you have forgotten the configuration protection code or do
  not find it in the log file, then you can not reconfigure the YubiKey
  slot again. This functionality is implemented to strengthen the
  security.</p>
</blockquote>

<p>Also, he wrote:</p>

<blockquote>
  <p>In the context of <a href="http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf" rel="nofollow">the manual</a>, an "unauthorized update of the
  configuration" would be changing the configuration settings on an
  unprotected YubiKey. Since you already have an access code in place,
  you cannot preform such an update.</p>
</blockquote>

<p><strong>But it should still be possible to "sabotage" a Mt. Gox Yubikey, no? If not, why? If so, how?</strong></p>

<p>thanks</p>

<p><strike>What is also strange is that when I try to create an account at <a href="http://forum.yubico.com" rel="nofollow">forum.yubico.com</a> or test my Yubikey at <a href="http://demo.yubico.com" rel="nofollow">demo.yubico.com</a>, they reject my OTP. Yubico Forum's registration says my OTP can't contain non alphanumeric characters, and it sometimes contains periods.</strike> [Update: this ended up being because I was using Dvorak keyboard layout for the Yubikey. I've changed it, and now my OTPs work on these sites.]</p>

<p>UPDATE #2: I found this: <a href="https://github.com/nezza/yubicrack" rel="nofollow">https://github.com/nezza/yubicrack</a>
But there has to be a quicker way than doing a brute-force search of the code. I really wonder why it is so hard to flash a Yubikey? Is it so that others can't render it effectively "lost" or "stolen"?</p>

CC BY-SA 3.0
2016-11-26T19:11:27.180Z
Since Mt. Gox's bankruptcy the unlock codes were leaked, see [What is Mt. Gox's YubiKeys' "configuration protection access code"?](http://bitcoin.stackexchange.com/questions/29702/what-is-mt-goxs-yubikeys-configuration-protection-access-code)
Tobias Kienzler
<security><mtgox><data-security><security-key>
How do I reconfigure a Mt. Gox Yubikey?
Geremia
# How do I reconfigure a Mt. Gox Yubikey?

(Asked by: username_0 on 2013-06-22)

After following [the instructions here](http://forum.yubico.com/files/VIPunlockGuide.pdf), which suggested I use [`ykpers`](http://yubico.github.io/yubikey-personalization/) or the [gui version](http://yubico.github.io/yubikey-personalization-gui/), I discovered the Mt. Gox Yubikey is protected by a "configuration protection access code."

From [the manual](http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf):

> **Protection of the key and configuration data**
>
> Given the symmetric nature of the AES encryption algorithm, the
> security of the Yubikey relies that the AES key is logically and
> physically protected both in the key and in the server that verifies
> the OTP.
>
> The configuration data is updated via a configuration API, accessible
> via the USB interface. To prevent unauthorized update, the
> configuration can be protected by a 48-bit access code. If used, an
> exhaustive search of all combinations would typically take some
> 100,000 years to perform. Furthermore, the Yubikey configuration data
> is write-only, i.e. configuration data and the key can only be written
> but not be read. This means that unauthorized update of the
> configuration is an act of sabotage rather than a security threat.
>
> The configuration data is stored in a non-volatile storage integral to
> the microcontroller. A potential attack is to physically probe the
> silicon or analyze the hardware behavior to potentially gain full or
> partial knowledge of the stored secrets. However, such an attack would
> require a complete break-up of the Yubikey, involving dissolving the
> microcontroller chip encapsulation. Furthermore, very advanced
> equipment is needed to probe the chip internals. Given the effort and
> costs involved for such an attack, this is not considered a threat
> given that just a single device will be broken.

Yubikey wrote me:

> In case, if you have forgotten the configuration protection code or do
> not find it in the log file, then you can not reconfigure the YubiKey
> slot again. This functionality is implemented to strengthen the
> security.

Also, he wrote:

> In the context of [the manual](http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf), an "unauthorized update of the
> configuration" would be changing the configuration settings on an
> unprotected YubiKey. Since you already have an access code in place,
> you cannot preform such an update.

**But it should still be possible to "sabotage" a Mt. Gox Yubikey, no? If not, why? If so, how?**

thanks

What is also strange is that when I try to create an account at [forum.yubico.com](http://forum.yubico.com) or test my Yubikey at [demo.yubico.com](http://demo.yubico.com), they reject my OTP. Yubico Forum's registration says my OTP can't contain non alphanumeric characters, and it sometimes contains periods. [Update: this ended up being because I was using Dvorak keyboard layout for the Yubikey. I've changed it, and now my OTPs work on these sites.]

UPDATE #2: I found this: <https://github.com/nezza/yubicrack>
But there has to be a quicker way than doing a brute-force search of the code. I really wonder why it is so hard to flash a Yubikey? Is it so that others can't render it effectively "lost" or "stolen"?

**Tags:** security, mtgox, data-security, security-key

> **Comments:**
> **username_1**: Since Mt. Gox's bankruptcy the unlock codes were leaked, see [What is Mt. Gox's YubiKeys' "configuration protection access code"?](http://bitcoin.stackexchange.com/questions/29702/what-is-mt-goxs-yubikeys-configuration-protection-access-code)  

---

## 2 answers

### Answer by username_1 on 2016-11-26. Score: 0 | Accepted answer

As answered in [a newer, strongly related question](https://bitcoin.stackexchange.com/q/29702/1137): You can now get the leaked keys from <https://bitcointalk.org/index.php?topic=631044.0>


---

### Answer by username_2 on 2013-06-23. Score: 1

Mt. Gox locks their Yubikeys with an access code. You cannot reprogram them without the code. If you're willing to wait a few months, you can [brute force](https://github.com/nezza/yubicrack) it.

> **Comments:**
> **username_0**: And they wouldn't release the access code because it would render the Yubikey useless with Mt. Gox? Why did they opt to make their Yubikeys exclusive for Mt. Gox?  
> **username_2**: @username_0: Doing it this way eliminates [a number of potential vulnerabilities](http://bitcoin.stackexchange.com/a/7171/85).  
> **username_0**: Do you know if Mt. Gox would release or has released the access code, now that they're belly-up? If so, we could reprogram the YubiKeys they sent us with a different access code and use them for other purposes. The YubiKey they sent me is just collecting dust…  

---

