YubiKey Firmware 5.7.x Changes for FIPS 140-3

Important

YubiKeys are shipped with FIPS approved mode OFF. The protocols and applications listed for FIPS 140-3 cannot create credentials until the YubiKeys are put in FIPS approved mode. See Initializing the Approved Mode.

The YubiKey 5 FIPS Series 5.7.4 firmware includes a number of changes for FIPS 140-3. The most notable of these changes is that the FIPS-specific requirements are now enforced by the YubiKey.

NIST classified the YubiKey 5 Series FIPS as “composite authenticators”. As such, no device in that series can be taken out of the FIPS-approved mode after initialization without zeroizing the function. This means that once the YubiKey is correctly configured, it remains in the correct configuration. This is what renders the --check-fips command unnecessary. As long as the crypto officer ensures that the YubiKey 5 Series FIPS devices are correctly configured at initialization, they remain in FIPS-approved mode.

Note

FIPS 140-2 is a regulation that was deprecated in May 2026. Auditors typically recommend that authenticators certified under FIPS 140-2 not be deployed in new deployments. They can continue to be used in existing deployments, but authenticators deployed in new environments must have a valid certificate that is not expired. FIPS 140-3 replaces FIPS 140-2, therefore any new submissions must fulfill the FIPS 140-3 requirements.

High-Level FIPS 140-3 Changes to YubiKey

  • Hardware-Enforced Compliance: The most notable change in FIPS 140-3 is that FIPS-specific requirements are now strictly enforced by the YubiKey itself.
  • No Pre-Validation Credential Creation: The device explicitly refuses to create credentials across any application until it is securely configured and in FIPS Approved Mode.
  • Stricter PIN Requirements: FIDO2, PIV, and OpenPGP now strictly enforce an 8-character minimum PIN length. PIN complexity is enabled by default to adhere to NIST SP800-63b guidelines.
  • Larger Key Sizes: To meet enterprise and Department of Defense (DoD) demands, the YubiKey supports larger key sizes to provide superior protection until Post-Quantum Cryptography matures.

For FIPS 140-3 configuration changes and additional FIPS Approved Mode information, see FIPS 140-3 Configuration.

FIDO2 Changes for FIPS 140-3

  • Requires a FIDO2 PIN of at least 8 characters.
  • Always Require User Verification (UV), alwaysUV, is permanently enabled and strictly enforced for operations.
  • U2F functionality is disabled on FIPS-capable devices under the 140-3 standard. Use FIDO2 functions instead.
  • PIN Protocol v2 must be over NFC.
  • Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.

See FIDO Initializing Approved Mode.

OATH Changes for FIPS 140-3

  • Requires an access code of at least 14 bytes.
  • Executing SET CODE and PUT commands over NFC, requires a secure channel (SCP03 or SCP11).
  • Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.

See OATH Initializing Approved Mode.

Open PGP Changes for FIPS 140-3

  • Requires changing the default User PIN, Admin PIN, and Reset Code (if set) to a minimum of 8 characters. Changing user PIN, admin PIN or Reset Code to a value shorter than 8 characters is blocked.
  • RSA decryption, X25519, and SECP256k1 are blocked.
  • Requires all operations over NFC go through a secure channel (SCP03 or SCP11).
  • Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.

See OpenPGP Initializing Approved Mode.

PIV Changes for FIPS 140-3

  • Requires changing the default PIN and PUK to 8-character values. Requires changing the Management Key to an AES key.
  • RSA1024, TDES (3DES), and X25519 are blocked algorithms. Cannot set the Management Key to TDES.
  • Requires all operations performed over NFC go through a secure channel (SCP03 or SCP11).
  • Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.

See PIV Initializing Approved Mode.

Security Domain (SCP03 and SCP11) Changes for FIPS 140-3

  • Requires changing the default key set.

  • Requires the application is in FIPS Approved Mode to create credentials.

    Until the application is in FIPS Approved Mode, the default key set can only be used to establish a secure channel with the Security Domain itself and only for the purpose of loading a new key set. This operation must be performed over USB.

See Security Domain Initializing Approved Mode.

YubiHSM Auth Changes for FIPS 140-3

  • Requires changing the default admin code.
  • Requires all operations performed over NFC go through a secure channel (SCP03 or SCP11).
  • Requires the application is in FIPS Approved Mode to create credentials. The device refuses to create credentials until it is in FIPS Approved Mode.

See HSMAuth Initializing Approved Mode