PIV Configuration with FIPS

The YubiKey 5 FIPS Series provides a PIV-compatible smart card application. PIV or FIPS 201, is a US government standard that enables RSA or ECC sign and encrypt operations using a private key stored on a smart card through common interfaces like PKCS#11.

For full description of YubiKey 5 with PIV, see Smart Card - PIV Compatible Specifics.

FIPS Exceptions

For YubiKey 5 FIPS Series, some exceptions apply:

• Do not use non-NIST-approved curves
• Do not use the following keys:

FIPS 140-3

• RSA 1024-bit
• Triple DES
• X25519

FIPS 140-2

• RSA 1024-bit
• 3072-bit keys.

These restrictions apply to Attestation as well.

• PIN policy = none cannot be used. Select either once or always.

Supported Algorithms

The YubiKey 5 FIPS Series supports the following algorithms on the PIV smart card application.

Supported PIV Algorithms per FIPS Version

Algorithm (Identifier)	FIPS Version
RSA-1024 (0x06)	140-2
RSA-2048 (0x07)	140-2
RSA-3072 (0x05)	140-3
RSA-4096 (0x16)	140-3
ECC P-256 (0x11)	140-2
ECC P-384 (0x14)	140-2
Ed25519/x25519 (0xe0)	–

PIV Smart Card Deployment

The YubiKey 5 FIPS Series PIV application implements a PIV-compatible standard as defined in the NIST SP 800-73-4 publication. Access to functions on the YubiKey 5 FIPS Series PIV application is restricted by the management key, the PIN, and the PUK.

The management key is used for:

• Importing or generating asymmetric key pairs
• Importing x.509 certificates and associated information
• Setting the retry counters for PIN (also requires PIN) and PUK

The PIN is used to:

• Perform cryptographic operations using private keys
• Change the PIN

The PUK is used to:

• Unblock and set a new PIN for a blocked PIN
• Change the PUK

The YubiKey 5 FIPS Series PIV application has the default values:

• Management Key (010203040506070801020304050607080102030405060708)
• PIN (123456)
• PUK (12345678)

PIV FIPS Approved Mode

This PIV FIPS approved mode supported for both FIPS 140-3 and FIPS 140-2.

To place the YubiKey 5 FIPS Series PIV application in the FIPS-approved mode of operation, change the default management key, PIN, and PUK.

YubiKey 5 FIPS Series devices should be deployed using a credential management tool like Microsoft ADCS and the YubiKey Minidriver or a third party tool. The credential management tool replaces the default values by automatically setting a random value for the management key and PUK and allows the end user to define the PIN. See YubiKey Minidriver User Guide.

If the YubiKey 5 FIPS Series PIV application is not being managed with a credential management tool, the management key, PIN, and PUK must be changed by the crypto officer. To do so, use ykman CLI.

• Download and install the latest version of YubiKey Manager (ykman), from ykman Releases.

• Reference the YubiKey Manager (ykman) CLI Guide.

  For GUI access, we recommend you use the Yubico Authenticator. The YubiKey Manager GUI is end of life.

To change the management key, use the command:

ykman piv access change-management-key
   -m010203040506070801020304050607080102030405060708 /
   -a<algorithm> -n<management key>

where -

<management key> is the new management key

<algorithm> is the key type:

• FIPS 140-3: AES-128, AES-192 or AES-256.
• FIPS 140-2: Triple-DES, AES-128, AES-192 or AES-256.

To change the PIN, use the command:

ykman piv access change-pin -P123456 -n<PIN>

where <PIN> is the new PIN.

To change the PUK, use the command:

ykman piv access change-puk -p12345678 -n<PUK>

where <PUK> is the new PUK.