Yubikey not working on iPad Pro Gen 5

[KDederichs]

Description
Keepassium is not recognizing the Yubikey on an iPad Pro Gen 5 if it’s plugged into a USB C to USB A adapter.
It’s showing the connect the Yubikey to lightning animation and then nothing happens.

How to reproduce
Steps to reproduce the behavior:
Have a Database with a yubikey
Connect the USB A Yubikey to an USB C to A adapter
Try to open the Database

Expected behavior
Keepassium recognizes the key.

Environment:

• Device: iPad Pro Gen 5
• OS: 15.0.2
• App Version: 1.26

[keepassium]

iOS does not work with YubiKey via USB interface, this is Apple's limitation:
https://keepassium.com/articles/how-to-use-yubikey/#compatibility-ipad
https://support.yubico.com/hc/en-us/articles/4404405824402-Can-I-use-my-YubiKey-with-iPads-

[scruel]

iOS does not work with YubiKey via USB interface, this is Apple's limitation: https://keepassium.com/articles/how-to-use-yubikey/#compatibility-ipad https://support.yubico.com/hc/en-us/articles/4404405824402-Can-I-use-my-YubiKey-with-iPads-

Sad :(

[tyalie]

Just wanna chime in here and mention that this restriction has been (partially?) lifted with iPadOS 16. Even the linked yubico support page mentions, that Yubico Authenticator now has support for USB-C YubiKey on iPadOS 16.1

As the situation has changed, I believe the issue should be reopened

[keepassium]

Quoting my earlier Reddit comment about iPadOS 16 changes:

Alas, the limitation remains.

YubiKeys have several communication interfaces via the physical USB port; each interface provides access to some of key's functions.

According to Yubico's developer:

We use TKSmartCard in the SDK and the iOS Authenticator app to communicate with the YubiKey over USB-C. This only support CCID so you'll only be able to connect to the PIV, OATH and management application on the YubiKey. Unfortunately the functionality you're referring to uses a different USB interface, so it will not work.

In other words, the new interfaces enabled by iPadOS 16 does open access to some additional YubiKey functions — except the challenge-response mode. Challenge-response mode still remains available only via the low-level USB HID protocol (this is hardwired in the YubiKey).

Unfortunately, iPadOS 16 still does not provide access to the HID protocol. There is a specialized HIDDriverKit, but it is macOS-only. The more generic USBDriverKit might make it possible to create a custom USB HID driver that would talk to the YubiKey (on M1 iPads only). But I would rather leave this task to Yubico — writing a USB driver is waaay out of scope for KeePassium the password manager.

[tyalie]

Yeah I found the reddit post afterwards.

Honestly this is a bit frustrating that this now mostly a software issue, where somebody/a group would just need to invest a bit of time into. But I can see how developing your own HID driver based on the RAW USB protocol might be a bit out of scope for this project.

[keepassium]

A user just reported that YubiKey 5Ci (Lightning + USB-C) works on iPadOS via the new Apple USB-C to Lightning adapter. Yes, this requires a Lightning-enabled YubiKey and the adapter is expensive, but this opens a possibility on using YubiKey on iPads with USB ports.

Update: tested it myself, it works.

[tinyapps]

Noticed here https://keepassium.com/articles/how-to-use-yubikey/#compatibility-ipad that the iPad Air 4 did not work with the YubiKey 5Ci and Apple’s USB-C to Lightning adapter. Can also report failure with the iPad Pro 11-inch (1st generation) running 17.1.2 and KeePassium Pro 1.48.142.

[keepassium]

Thank you, @tinyapps. Luckily, the adapter (in)compatibility is a software issue that I'm going to fix on KeePassium's side. (See Yubico/yubikit-ios#144)

[tinyapps]

That's great news, @keepassium! Thanks so much for the update. Sorry to have replied in a closed issue - did not notice that until after submission (had stumbled onto the page via a Google search).

[keepassium]

@tinyapps , it should be fixed now in v1.50.

[tinyapps]

Thanks so much, @keepassium - worked beautifully on the aforementioned iPad Pro 11-inch (1st generation) running 17.3 with a YubiKey 5Ci and Apple’s USB-C to Lightning adapter. This is huge news for Keepassium users. I've purchased a Pro license, but is there another way to directly donate to the project?