YubiKey Firmware 5.7.x Changes for FIPS 140-3
The YubiKey 5 FIPS Series based on the 5.7.x firmware has a number of changes for FIPS 140-3. The most notable of these changes is that the FIPS-specific requirements are now enforced by the YubiKey.
Important
YubiKeys are shipped with FIPS approved mode OFF. The protocols and applications listed for FIPS 140-3 cannot create credentials until the YubiKeys are put in FIPS approved mode. See Initializing the Approved Mode.
High-Level FIPS 140-3 Changes to YubiKey
- Hardware-Enforced Compliance: The most notable change in FIPS 140-3 is that FIPS-specific requirements are now strictly enforced by the YubiKey itself.
- No Pre-Validation Credential Creation: The device explicitly refuses to create credentials across any application until it is securely configured and in FIPS Approved Mode.
- Stricter PIN Requirements: FIDO2, PIV, and OpenPGP now strictly enforce an 8-character minimum PIN length. PIN complexity is enabled by default to adhere to NIST SP800-63b guidelines.
- Larger Key Sizes: To meet enterprise and Department of Defense (DoD) demands, the YubiKey supports larger key sizes to provide superior protection until Post-Quantum Cryptography matures.
For FIPS 140-3 configuration changes and additional FIPS Approved Mode information, see FIPS 140-3 Configuration.
FIDO2 Changes for FIPS 140-3
- Requires a FIDO2 PIN of at least 8 characters.
- Always Require User Verification (UV),
alwaysUV, is permanently enabled and strictly enforced for operations. - U2F functionality is disabled on FIPS-capable devices under the 140-3 standard. Use FIDO2 functions instead.
- PIN Protocol v2 must be over NFC.
- Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.
OATH Changes for FIPS 140-3
- Requires an access code of at least 14 bytes.
- Executing
SET CODEandPUTcommands over NFC, requires a secure channel (SCP03 or SCP11). - Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.
Open PGP Changes for FIPS 140-3
- Requires changing the default User PIN, Admin PIN, and Reset Code (if set) to a minimum of 8 characters. Changing user PIN, admin PIN or Reset Code to a value shorter than 8 characters is blocked.
- RSA decryption, X25519, and SECP256k1 are blocked.
- Requires all operations over NFC go through a secure channel (SCP03 or SCP11).
- Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.
PIV Changes for FIPS 140-3
- Requires changing the default PIN and PUK to 8-character values. Requires changing the Management Key to an AES key.
- RSA1024, TDES (3DES), and X25519 are blocked algorithms. Cannot set the Management Key to TDES.
- Requires all operations performed over NFC go through a secure channel (SCP03 or SCP11).
- Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.
Security Domain (SCP03 and SCP11) Changes for FIPS 140-3
Requires changing the default key set.
Requires the application is in FIPS Approved Mode to create credentials.
Until the application is in FIPS Approved Mode, the default key set can only be used to establish a secure channel with the Security Domain itself and only for the purpose of loading a new key set. This operation must be performed over USB.
YubiHSM Auth Changes for FIPS 140-3
- Requires changing the default admin code.
- Requires all operations performed over NFC go through a secure channel (SCP03 or SCP11).
- Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.
Changes for FIPS 140-3 - Check Duplicates
The YubiKey 5 FIPS Series 5.8 firmware includes a number of changes for FIPS 140-3 submission. The most notable of these changes is that the FIPS-specific requirements are now enforced by the YubiKey.
YubiKey 5 FIPS Series offers strong authentication with support for multiple protocols, including FIDO2, which is the new standard that enables the replacement of password-based authentication. The YubiKey strengthens security by replacing passwords with strong hardware-based authentication using public key cryptography.
The cryptographic functionality of the YubiKey 5 FIPS Series devices is powered by the YubiKey 5 cryptographic module, a single-chip cryptographic processor with a non-extractable key store that handles all of the cryptographic operations.
The YubiKey 5 FIPS Series cryptographic module is a security feature that supports multiple protocols designed to be embedded in USB security tokens. The module can generate, store, and perform cryptographic operations for sensitive data. It is accessed through an external touch-button for Test of User Presence in addition to PIN for smart card authentication. The module implements the following major functions, depending on the firmware version on the YubiKey.
NIST classified the YubiKey 5 Series FIPS as “composite authenticators”. As such, no device in that series can be taken out of the FIPS-approved mode after initialization without zeroizing the function. This means that once the YubiKey is correctly configured, it remains in the correct configuration. This is what renders the --check-fips command unnecessary. As long as the crypto officer ensures that the YubiKey 5 Series FIPS devices are correctly configured at initialization, they remain in FIPS-approved mode.
Note
FIPS 140-2 is a regulation that will be deprecated in May 2026. At that point, auditors typically recommend that authenticators certified under FIPS 140-2 not be deployed in new deployments. They can continue to be used in existing deployments, but authenticators deployed in new environments must have a valid certificate that is not expired. FIPS 140-2 is being replaced by FIPS 140-3, therefore any new submissions must fulfill the FIPS 140-3 requirements.