Using the Yubico PIV Tools and YubiKey PIV Manager, I can load my client TLS certificate into the PIV slot and use it for authentication in Firefox. This is great. However...
Is there any way to prevent export of the private key of the PIV? As far as I can tell, the PIV management key only protects the device from modification, but does nothing to protect the contained contents from export.
If this is accurate, the YubiKey doesn't really seem to function as a PIV 2FA device, since 2-factor presumes "something you have", and any machine I plug the device into (or software running in the background) can just make fully functional soft copy.
I cross-posted this question in the Yubico forums.
Here's how I demonstrated the problem:
- Exported cert via "YubiKey PIV Manager" (my-cert.crt)
- Deleted cert from YubiKey via "YubiKey PIV Manager"
- Imported cert via "YubiKey PIV Manager" (my-cert.crt)
- Restarted Firefox (with OpenSC loaded)
- I was still able to authenticate via PIV