YubiHSM 2 Product Overview

The YubiHSM 2 is a small hardware device that keeps cryptographic keys safe. It is a fully capable Hardware Security Module (HSM) designed to store, manage, and use sensitive key material such as the private keys used for signing software, authenticating servers, or encrypting data.

Beyond protecting keys, the YubiHSM 2 also provides:

  • Fine-grained access control: Different applications and users can be given precisely the permissions they need, and no more.
  • A tamper-evident audit log: Every operation performed on the device is recorded, supporting compliance and forensic investigation.
  • Key backup and transfer: Keys can be securely moved between devices without ever being exposed in plaintext, enabling disaster recovery and redundancy.

The YubiHSM 2 is designed to be integrated directly into server-side applications and infrastructure. It communicates over USB and is supported by an open SDK, a PKCS#11 interface, and command-line tools.

Device Specifications

_images/YubiHSM2-Hero-FIPS1403-2k-v5.png

YubiHSM 2 Physical Device

For technical specifications and capabilities, performance, and physical characteristics, see the YubiHSM 2 technical data sheet.

The YubiHSM 2 SDK is built and provides for the following operating systems: Windows, macOS, and selected Linux distributions. See YubiHSM2 Releases for most recent platform YubiHSM2 downloads.

FIPS Certified

Note

This topic applies to YubiHSM 2 FIPS devices only.

The YubiHSM 2 is available in a FIPS-capable version called YubiHSM 2 FIPS.

YubiHSM 2 FIPS devices include the text “FIPS” inscribed onto the surface of the device and allow YubiHSM 2 FIPS to run in FIPS Approved mode.

_images/YubiHSM2-HeroR-FIPS1403-2k-v5.png

YubiHSM 2 FIPS Marking

FIPS Validation

YubiHSM 2 FIPS devices with firmware version 2.4.1 are FIPS 140-3 Security Level 3 validated. These devices can be used in solutions that are meant to comply with FIPS 140-3 requirements. For National Institute of Standards and Technology (NIST), see Cryptographic Module Validation Program CMVP, #5302.

Note

  • Effective May 29 2026, YubiHSM FIPS Series with firmware 2.4.1 was NIST certified for FIPS 140-3.
  • Effective May 2026, YubiHSM FIPS Series with firmware 2.2.0 with NIST FIPS 140-2 certification was moved to Sunset List.
  • Effective September 22, 2026, All NIST FIPS 140-2 certification will be moved to the Historical List.

FIPS Mode

The YubiHSM 2 FIPS can be configured in an approved mode and a non-approved mode of operation. In the approved mode, only FIPS-approved algorithms are supported. In the non-approved mode, additional non-approved algorithms such as rsa-pkcs1-sha1 are supported.

FIPS-approved mode configuration requires, that you:

  1. Enable the fips-mode option. This resets the device. See Set FIPS Mode.
  2. Immediately change the default Authentication key. See CHANGE AUTHENTICATION KEY Command.

FIPS 140-3 Changes

Disabled Cryptographic Features in FIPS Mode

The algorithms and services listed in the table below are disallowed by FIPS. When a device is in FIPS mode, the algorithms are disabled and cannot be enabled as long as the device is in FIPS mode. When the listed algorithms are disabled in FIPS mode, it means corresponding services listed are also disallowed.

Disabled algorithms Disabled services
ecdsa-sha1 ECDSA Signature Generation using SHA-1
eck256 Support for EC keys with curve secp256k1
rsa-pkcs1-decrypt Decryption using PKCS#1 v1. 5
rsa-pkcs1-sha1 RSA PKCS#1 Signature Generation with SHA-1
rsa-pss-sha1 RSA PSS Signature Generation with SHA-1

Default authentication key

When in FIPS mode, the default authentication key must be changed. YubiHSM does not accept any commands, except change authentication key, until the default authentication key is changed.

To switch from FIPS mode to non-FIPS mode or vice versa, requires that all the objects created in the current mode, except the default authentication key, are deleted. The same as resetting the device.

FIPS Key Attestation

  • A key attestation generated on a YubiHSM 2 FIPS device with firmware version 2.4.1 or newer has an X.509 extension present with OID 1.3.6.1.4.1.41482.4.12.

    If the key attestation was generated in FIPS-approved mode, this extension BOOLEAN value is TRUE. Otherwise, the BOOLEAN value is FALSE.

  • The pre-loaded certificate of a YubiHSM 2 FIPS device has an X.509 extension present with OID 1.3.6.1.4.1.41482.4.10. This extension has an INTEGER value encoding its FIPS certificate.

    • Value 9 refers to the YubiHSM 2 FIPS 140-3 NIST certificate 5302 for firmware version 2.4.1.
    • Value 6 refers to the YubiHSM 2 FIPS 140-2 NIST certificate 3916 for firmware version 2.2.0.

    See FIPS Arc Values for additional FIPS Certificate validation information.