A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written.

Yubico:


  The YubiKey AES Key information can never be extracted from a YubiKey
  device – only programmed to it.


Nitrokey:


  Other than ordinary software solutions, the secret keys are always
  stored securely inside the Nitrokey. Their extraction is impossible
  which makes Nitrokey immune to computer viruses and Trojan horses.


The claim as literally stated seems like marketing nonsense. The dongle itself has access to the private key so somehow it can be read.

Still, it's an interesting claim. The choice of words -- "never", "always", "impossible" -- suggest that there is something that can be proven here. Or maybe I'm giving them too much credit. Is there anything to this? What is it?

My guess is that they mean it's impossible to extract the private key without physically tampering with the crypto-dongle. It seems plausible that one could show that there simply is no physical channel for relaying the private key outside of the device. That complicates writing the key and I can't see how that could be solved. One way I could see is to not write the key verbatim but somehow allow it to be randomized, but I believe these devices actually allow writing the key.

Or maybe there's more substance to it than that. For all I know theses devices uses some exotic mechanism for storing bits that really can't be read directly without destroying the device.



I did find an answer here suggesting there is some real meat to this but it doesn't go into detail.

https://security.stackexchange.com/a/92796/45880


  Extracting private keys directly from the card is nearly impossible.
  With some acid package destruction and electron microscope work, a
  skilled team, and enough time, money, and luck you can in theory
  extract keys but it involves not only physical access but a scenario
  where the card will be physically destroyed.


Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it.  By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private key."  The latter is certainly not impossible, but it is a lot more difficult.

Those usb dongles work very similar to smartcards.  I have more experience with smartcards so I will use that in the answer but most of the same principles apply.  In fact many of those usb dongles use a smart card SoC internally.  They are cheap, programmable, and offer robust security so in many applications it makes sense to just use a smartcard internally rather than try to build something new.

A programmable smartcard is a complete computer in a single chip, or system on a chip (SoC).  Now it is a very limited computer but still a computer.  The connection to the "outside world" for the smartcard is a low privilege simple serial interface.  The card gets a command (more like a request) from the host and the card responds with a response.  The commands are limited to what the card has been programmed to do.

So if we have a smart card programmed to digitally sign an instruction (like a payment request in credit card EMV), the host will send a request over the serial interface to the card consisting of a command and some inputs.  The card parsed the command and assuming it is valid it sends back a digital signature to the host over the same interface.  In many ways it resembles a client-server relationship with the smartcard being the server and the host system being the client.  The private key never leaves the card during the process.  It is just request in, response out.  The host has no mechanism to force the smartcard to return the private key or do anything it wasn't programmed to do.  Of course this assumes there is no "please give me all the private keys" command which would obviously be pointless and provide no security.  The smartcard may have a user assigned PIN and the PIN is part of the command format.  The smartcard verifies the PIN and if it is invalid will reject the command.  It has its own internal memory so it may record internally the number of invalid attempts and be programmed to shutdown (or in extreme cases erase the card).

The programming (flashing) of a smartcard is done prior to shipping.  Of course if an attacker could just reprogram the smartcard to run a "give me all your keys" program it wouldn't be secure so most cards employ some sort of security bit in write once memory.  So the card is programmed and the write bit set.  The card will then reject any future attempts to reprogram.   

Try not to get hung up on a smartcard doing exactly this.  They are programmable devices so they will vary in implementation but the general concept is you have this self contained computer with its own internal secure storage which has been programmed to respond to requests from a host over a simple low permission interface.  I do agree the word "impossible" is marketing but it isn't that far from the truth.  You could say practically impossible.  The very basic design and locked functionality means you end up with a hardened device that is difficult to attack.

However the old axiom "there is no information security without physical security" still applies.  The private key is still physically in the smartcard.  With physical access and enough motivation you can do pretty much "unsecret" any secret. As in the linked example the smartcard can be bypassed and the key read out directly off the physical memory.  A common method is to take the card, remove the SoC and use acid deconstruction to burn away package.  Using an electron microscope and enough skill you could locate the spot on the silicon which stores the keys, connect leads and read them out. It has been done so it definitely is not impossible but in most cases that isn't the type of attack or attacker we are trying to defend against.  Honestly if your attacker would go to that level I would be more worried about a $5 wrench.  
