YubiKey 5 FIPS Series Features

NIST classified the YubiKey 5 Series FIPS as “composite authenticators”. As such, no device in that series can be taken out of the FIPS-approved mode after initialization without zeroizing the function. This means that once the YubiKey is correctly configured, it remains in the correct configuration. As long as the crypto officer ensures that the YubiKey 5 Series FIPS devices are correctly configured at initialization, they remain in FIPS-approved mode.

Note

FIPS 140-2 is a regulation that will be sunsetted in May 2026. At that point, auditors typically recommend that authenticators certified under FIPS 140-2 not be deployed in new deployments. They can continue to be used in existing deployments, but authenticators deployed in new environments must have a valid certificate that is not expired. FIPS 140-2 is being replaced by FIPS 140-3, therefore any new submissions must fulfill the FIPS 140-3 requirements.

NIST Version Certification

The YubiKey 5 cryptographic module is FIPS 140-2 certified, both Level 1 and Level 2 (Physical Security Level 3) and in certification process for FIPS 140-3.

Per NIST document FIPS 140-3 Transition Effort, YubiKey 5 FIPS Series certification is affected:

  • The YubiKey 5 FIPS Series hardware with the 5.4 firmware is certified as an authenticator under both FIPS 140-2 Level 1 and Level 2. It meets the highest authenticator assurance level 3 (AAL3) of NIST SP800-63B guidance. To use security keys from the YubiKey 5 FIPS Series as a Level 2, more stringent initialization is required than for Level 1. Guidance for Level 2 is detailed in FIPS 140-2 Level 2 Changes and Configuration. Guidance for Level 3 is set out in FIPS 140-3 Changes.

    Effective September 22, 2026, this certification will be moved to the Historical List.

  • FIPS 140-3 certification based on YubiKey 5 FIPS Series firmware version 5.7.4 is in coordination phase. YubiKey 5 FIPS Series is not yet certified FIPS 140-3, but it shares the cryptographic module major functions.

YubiKey 5 Firmware Support for Cryptographic Module Major Functions

The following table lists the FIPS cryptographic modules and protocols supported with the YubiKey 5 firmware versions.

Cryptographic Functions per Firmware Version
Function Firmware Versions
5.7.4 5.4.3 5.4.2
FIDO Universal 2nd Factor (U2F)
FIDO2 WebAuthn 140-3 140-2 140-2
OATH OTP authentication 140-3 140-2 140-2
One Time Password (Yubico OTP)
140-2 140-2
OpenPGP (version 3.4) 140-3 140-2
PIV-compatible smart card 140-3 140-2 140-2
SCP03 140-3 140-2 140-2
SCP11 140-3
YubiHSM Auth 140-3 140-2

Note

  1. The 5.7.4 is not a FIPS key, but it shares the cryptographic module major functions.
  2. OTP YubiKeys are labeled FIPS, and are usable, but are not certified as FIPS.

The YubiKey 5 FIPS Series hardware with the 5.4 firmware is certified as an authenticator under both FIPS 140-2 Level 1 and Level 2. It meets the highest authenticator assurance level 3 (AAL3) of NIST SP800-63B guidance. To use security keys from the YubiKey 5 FIPS Series as a Level 2, more stringent initialization is required than for Level 1. Guidance for Level 2 is detailed in FIPS 140-2 Level 2 Changes and Configuration. Guidance for Level 3 is set out in FIPS 140-3 Changes.

FIPS AAGUID and Form Factors

Form factor is set during manufacturing and returned as a one-byte value. Currently defined values for this are set out in the Form Factor table below:

Form Factor
Form Factor
YubiKey Value
Security Key
Value, FW 5.4+
FIPS YubiKey
Value, FW 5.4+
UNDEFINED 0x00 N/A N/A
Keychain, USB-A 0x01 0x41 0x81
Nano, USB-A 0x02 N/A 0x82
Keychain, USB-C 0x03 0x43 0x83
Nano, USB-C 0x04 N/A 0x84
Keychain with
Lightning, USB-C
 0x05 N/A x85

Credentials and Permitted Values

The table below lists the credentials required, allowed values, and credential owner for the supported applications as of FIPS 140-2 Level 2.

Credentials Required and Allowed
Application Credential Permitted Values
Credential
Owner
OATH
Authentication
Key
14-64 byte HMAC
SHA1/SHA256 key
 Crypto Officer
One Time Password
(OTP)
Access Code:
OTP Slot 1
OTP Slot 2
6 byte access codes
6 byte access codes
 Crypto Officer
OpenPGP
User Password
(PW1)
 6-127 byte PIN
Authenticated
User
Admin Password
(PW3)
 8-127 byte PIN Crypto Officer
PIV Smart Card Management Key 3-key TDES key Crypto Officer
PUK 6-8 byte PIN Crypto Officer
PIN 6-8 byte PIN
Authenticated
User
WebAuthn PIN 6 to 32 byte PIN
Authenticated
User

The instructions for the individual applications are provided in the following topics:

For more information on secure channel requirements from NIST, see NIST SP 800-63-C and NIST SP 800-63B.