Introductions to the Different YubiKey Series — YubiKey Technical Manual documentation (2024)

About the YubiKey 5 Series

The YubiKey 5 Series security keys offer strong authentication with support for multiple protocols, including FIDO2, which is the new standard that enables the replacement of password-based authentication. The YubiKey strengthens security by replacing passwords with strong hardware-based authentication using public key cryptography.

• For those who just want to use a YubiKey without programming anything, the most useful part of this guide is Understanding the USB Interfaces. This topic describes how the YubiKey connects and indicates what it can connect to.

  See Also

  Amazon Web Services (AWS) - FIDO AllianceAmazon - Authy

  For an overview on setting up two-step verification in a typical case, see Google on using a security key for 2-step verification.

• The full list of the services that work with YubiKeys is on Yubico’s Works With YubiKey page.

• Most of the rest of this guide targets systems integrators, IT teams, or developers who expect to integrate support for YubiKeys into their environment.

All the YubiKeys in the YubiKey 5 Series have the basic functionalities and capabilities described in this guide. However, it is the firmware version that determines which of the more specialized functionalities and capabilities are available on your YubiKey.

Why FIPS?

Federal Information Processing Standards (FIPS) are developed by the United States government for use in computer systems to establish requirements such as ensuring computer security and interoperability. The National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS) run the NIST Cryptographic Module Validation Program (CMVP) as a collaborative effort.

FIPS certification demonstrates that a product has gone through a rigorous audit process and adheres to a security standard that can be measured and quantified.

Many government organizations and government contractors are required to use FIPS-approved products, as are highly-regulated industries in general. Other countries also recognize FIPS 140-2. For the U.S. government, the default is that FIPS is required.

Do You Require FIPS Keys?

If you do not have a security auditor, and/or the auditor does not have a compliance requirement, you probably do not need FIPS. The standard line of YubiKeys offers the same security, algorithms, and functionality. The standard line also evolves at a much more rapid pace because it does not need complete an exhaustive validation process, which commonly takes a year or more. Yubico can release standard firmware with new features and enhancements at any time, whereas FIPS-certified products complete the FIPS validation process every time there is a change.

About the YubiKey 5 FIPS Series

The YubiKey 5 FIPS Series is FIPS 140-2 certified. It offers strong authentication with support for multiple protocols - including FIDO2, which is the new standard that enables the replacement of password-based authentication. The YubiKey strengthens security by replacing passwords with strong hardware-based authentication using public key cryptography.

The cryptographic functionality of the YubiKey 5 FIPS Series devices is powered by the FIPS 140-2 certified YubiKey 5 cryptographic module, a single-chip cryptographic processor with a non-extractable key store that handles all of the cryptographic operations. The YubiKey 5 cryptographic module is FIPS 140-2 certified, both Level 1 and Level 2 (Physical Security Level 3).

The YubiKey 5 FIPS Series cryptographic module is a security feature that supports multiple protocols designed to be embedded in USB security tokens. The module can generate, store, and perform cryptographic operations for sensitive data and is accessed through an external touch-button for Test of User Presence in addition to PIN for smart card authentication. The module implements the following major functions, depending on the firmware version on the YubiKey:

The YubiKey 5 FIPS Series hardware with the 5.4 firmware is certified as an authenticator under both FIPS 140-2 Level 1 and Level 2. It meets the highest authenticator assurance level 3 (AAL3) of NIST SP800-63B guidance. To use security keys from the YubiKey 5 FIPS Series as a Level 2, more stringent initialization is required than for Level 1. Guidance for Level 2 is detailed in the following topics.

FIPS-specific Aspects of the YubiKey 5 FIPS Series

The table below lists the YubiKey 5 FIPS Series with the 5.4 firmware includes configuration changes that are set at programming. These are in addition to the configuration available in the YubiKey 5 FIPS Series.

1. The certifications that are supported by a FIDO authenticator can be returned in the certifications member of an authenticatorGetInfo response as set out in paragraph 7.3.1. Authenticator Actions of the Client to Authenticator Protocol (CTAP) Review Draft of March 09, 2021.
2. Form factor is set during manufacturing and returned as a one-byte value. Currently defined values for this are:

Firmware

YubiKeys are programmed in Yubico’s facilities with the latest available firmware and once programmed cannot be updated to another version. The firmware cannot be altered or removed from a YubiKey.

Yubico periodically updates the firmware to take advantage of features and capabilities introduced into the ecosystem.

The firmware version on a YubiKey or an HSM determines whether or not a feature or a capability is available to that device. The quickest and most convenient way to determine your device’s firmware version is to use the YubiKey Manager tool (ykman), a lightweight software package installable on any OS. The YubiKey Manager has both a graphical user interface (GUI) and a command line interface (CLI).

• Download the YubiKey Manager tool: https://www.yubico.com/products/services-software/download/yubikey-manager/

Yubico submitted the firmware for releases 5.4.2 and 5.4.3 to NIST and the organization approved the certification. The certificates can be found here.

Yubico submitted release 5.4.2 to ANSSI for certification and the organization approved the certification. For more information about the YubiKey 5 CSPN Series see YubiKey 5 CSPN Series.

Protocols Supported

Both keys in the YubiKey Bio Series support the FIDO authentication protocols, and work with sites and applications that support the FIDO2 and FIDO U2F protocols (for more information, see YubiKey Bio and FIDO2 and YubiKey Bio and FIDO U2F). FIDO2 (sometimes referred to as WebAuthn) builds upon FIDO U2F, and is the standard that enables the replacement of password-based authentication.

The YubiKey Bio Series provides firmware applications to support two modes of authentication through the FIDO2 and U2F protocols (see YubiKey Bio and FIDO2 and YubiKey Bio and FIDO U2F). Even though the firmware applications are separate from one another, they both share the same PIN and FIDO reset capability. In fact, a FIDO reset resets both applications. To manage these applications, see Tools.

Using the YubiKey Bio

For a quick start to using the YubiKey Bio Series, without a lot of details, see Yubico’s setup page.

This guide, the YubiKey Technical Manual, provides:

• An explanation of the way the YubiKey Bio works and descriptions of the different user experiences with the various protocols
• Full instructions for enrolling fingerprints using platform support:
  • Using Chrome to Enroll Fingerprints and
  • Using Windows to Enroll Fingerprints
• Brief descriptions of the protocols supported in YubiKey Bio and FIDO2 and YubiKey Bio and FIDO U2F
• A brief explanation of the role the Yubico Authenticator for Desktop plays in managing the YubiKey Bio, plus links for downloading it and to its documentation.

Usage Notes

The YubiKey Bio implements biometrics as outlined in the CTAP 2.1 specification. The best user experiences are provided by the YubiKey Bio with client applications and browsers that also implement CTAP 2.1. Applications and browsers that implement CTAP 1 or CTAP 2.0 also work with the YubiKey Bio. However, the UI on client devices is not as intuitive and there might be some limitations.

Interfaces and Applications

Scope

This document describes how to configure and use the YubiKey 5 in compliance with CSPN (“Certificat de Sécurité de Premier Niveau” [RD1]).

For each YubiKey application that requires specific configuration, the documentation provides a short introduction, the required settings to achieve the target, and a technical description of the configuration.

References

Click for Yubico Support.