Firmware Overview
The firmware version on a YubiKey or a Security Key determines whether or not a feature or a capability is available to that device. The quickest and most convenient way to determine your device’s firmware version is to use either the Yubico Authenticator with its intuitive and easy-to-use (GUI) interface or ykman the lightweight command line (CLI) software package installable on many OSs.
Note
Yubico periodically updates its firmware to take advantage of features and capabilities introduced into the ecosystem. YubiKeys are programmed in Yubico’s facilities with the latest available firmware. Once programmed, YubiKeys cannot be updated to another version. The firmware cannot be altered or removed from a YubiKey.
Form
Factor
|
YubiKey
Form
Name
|
Firmware Versions | ||||||
|---|---|---|---|---|---|---|---|---|
| 5.8 | 5.7.x | 5.5.x | 5.4.x | 5.3.x | 5.2.x | 5.0.x | ||
| USB-A + NFC | 5 NFC | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| USB-C + NFC | 5C NFC | Yes | Yes | Yes | Yes | Yes | Yes | |
| USB-A Nano | 5 Nano | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| USB-C Nano | 5C Nano | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| USB-A + bio sensor | 5 Bio | Yes | Yes | Yes | ||||
| USB-C + bio sensor | 5C Bio | Yes | Yes | Yes | ||||
| USB-C + Lightning | 5Ci | Yes | Yes | Yes | Yes | Yes | ||
YubiKey 5 Series
The features, capabilities, and enhancements of the YubiKey 5 Series that are dependent on firmware version are listed below in the Firmware Capability Matrices.
5.8 Firmware - FIDO2 and CTAP 2.3
The 5.8. firmware for the YubiKey 5 Series has a number of features that are available for the first time on the YubiKey 5. The changes and additions are described in detail in 5.8 Firmware Specifics. In addition to the features that are directly accessible, there are a number of features that require partner support.
5.7.4 Firmware - FIPS Series
The 5.7.4 new features include:
- Certified to NIST’s Cryptographic Module Validation Program for FIPS 140-3 validation.
- Enterprise Attestation to support use cases such as derived FIDO credentials
- FIDO2, PIV and OpenPGP minimum PIN length is now 8
- PIN complexity is on by default to adhere to NIST Special Publication 800-63B (and 800-63B-4)
- Larger keys sizes provide better protection than smaller key sizes until Post-Quantum-Cryptography is mature.
5.7 and 5.6 Firmware Prior to 5.7.4
The 5.7 and 5.6 new features include:
- The NFC function with firmware 5.7 is off by default. Plugging the YubiKey into the device in activates the NFC function. For more detail on this specific feature, see Restricted NFC.
- The 5.7. firmware for the YubiKey 5 Series has a number of features that are available for the first time on the multi-protocol YubiKey 5.
Firmware Capability Matrices
For form factors released with which firmware versions, see Introduction to the YubiKey Series.
YubiKey 5 Series
Features
|
Firmware Versions | ||||||
|---|---|---|---|---|---|---|---|
| 5.8.x | 5.7.x | 5.5.x | 5.4.x | 5.3.x | 5.2.x | 5.0.x | |
| AlwaysUV | Yes | Yes | |||||
Attestation
Enterprise
|
Yes | Yes | |||||
| Blob Storage | Yes | Yes | |||||
| Serial Number | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| YubiHSM Auth | Yes | Yes | Yes | ||||
| CTAP | |||||||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
Yes | ||||||
| Pseudo-Random (PRF) | Yes | ||||||
| Reset LongTouch | Yes | ||||||
| Reset Transport | Yes | ||||||
| Third Party Payment | Yes | ||||||
| FIDO | |||||||
| FIDO2 CTAP 2.3 | Yes | ||||||
| FIDO U2F | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 | 25 | 25 | 25 | 25 | 25 |
| FIDO2 PIN Mgmt | Yes | Yes | |||||
| FIDO2 over CCID | Yes | ||||||
| Protocols | |||||||
| OATH | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
OATH Credential
Storage
|
64 | 64 | 32 | 32 | 32 | 32 | 32 |
| OpenPGP version | 3.4 | 3.4 | 3.4 | 3.4 | 3.4 | 2.1 | 2.1 |
| OTP | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| PIV/Smart Card | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| SCP03 | Yes | Yes | Yes | Yes | |||
| SCP11 | Yes | 5.7.4+ | |||||
YubiKey 5 FIPS Series
Features
|
Firmware Versions | ||
|---|---|---|---|
| 5.7.4 | 5.4.3 | 5.4.2 | |
| AlwaysUV | |||
Attestation
Enterprise
|
|||
| Blob Storage | |||
| Serial Number | Yes | Yes | Yes |
| YubiHSM Auth | Yes | Yes | Yes |
| CTAP | |||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
Yes | ||
| Pseudo-Random (PRF) | |||
| Reset LongTouch | |||
| Reset Transport | |||
| Third Party Payment | |||
| FIDO | |||
| FIDO2 CTAP 2.3 | |||
| FIDO U2F | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 | 25 |
| FIDO2 PIN Mgmt | |||
| FIDO2 over CCID | Yes | ||
| Protocols | |||
| OATH | Yes | Yes | Yes |
OATH Credential
Storage
|
|||
| OpenPGP version | 3.4 | 3.4 | 3.4 |
| OTP | Yes | Yes | Yes |
| PIV/Smart Card | Yes | Yes | Yes |
| SCP03 | Yes | Yes | Yes |
| SCP11 | Yes | ||
Note
YubiKey FIPS series remains on firmware version 5.7.4 while FIPS certification for firmware 5.8 is processing.
YubiKey 5 Series - Enhanced PIN
YubiKey 5 Enhanced PIN Series requires a subscription to YubiKey as a Service. Contact Yubico sales team for information about YubiKey as a Service.
Features
|
Firmware Versions | |
|---|---|---|
| 5.8.x | 5.7.4 | |
| AlwaysUV | Yes | Yes |
Attestation
Enterprise
|
Yes | Yes |
| Blob Storage | Yes | Yes |
| Serial Number | Yes | Yes |
| YubiHSM Auth | Yes | Yes |
| CTAP | ||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
Yes | |
| Pseudo-Random (PRF) | Yes | |
| Reset LongTouch | Yes | |
| Reset Transport | Yes | |
| Third Party Payment | Yes | |
| FIDO | ||
| FIDO2 CTAP 2.3 | Yes | |
| FIDO U2F | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 |
| FIDO2 PIN Mgmt | Yes | Yes |
| FIDO2 over CCID | Yes | |
| Protocols | ||
| OATH | Yes | Yes |
OATH Credential
Storage
|
64 | 64 |
| OpenPGP version | 3.4 | 3.4 |
| OTP | Yes | Yes |
| PIV/Smart Card | Yes | Yes |
| SCP03 | Yes | Yes |
| SCP11 | Yes | Yes |
YubiKey 5 CCN Series
Features
|
Firmware Versions | |
|---|---|---|
| 5.8.x | 5.7.4 | |
| AlwaysUV | Yes | Yes |
Attestation
Enterprise
|
Yes | Yes |
| Blob Storage | Yes | Yes |
| Serial Number | Yes | Yes |
| YubiHSM Auth | Yes | Yes |
| CTAP | ||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
||
| Pseudo-Random (PRF) | ||
| Reset LongTouch | ||
| Reset Transport | ||
| Third Party Payment | ||
| FIDO | ||
| FIDO2 CTAP 2.3 | ||
| FIDO U2F | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 |
| FIDO2 PIN Mgmt | Yes | Yes |
| FIDO2 over CCID | ||
| Protocols | ||
| OATH | Yes | Yes |
OATH Credential
Storage
|
64 | 64 |
| OpenPGP version | 3.4 | 3.4 |
| OTP | Yes | Yes |
| PIV/Smart Card | Yes | Yes |
| SCP03 | Yes | Yes |
| SCP11 | Yes | Yes |
YubiKey Bio Series
The listed firmware versions apply to both YubiKey Bio Series and YubiKey Bio Series - Multi-Protocol editions, unless indicated.
Yubico Bio Series - Multi-Protocol Edition requires a subscription to YubiKey as a Service. Contact Yubico sales team for information about YubiKey as a Service.
Features
|
Firmware Versions | |||
|---|---|---|---|---|
| 5.8.x | 5.7.x | 5.6.x | 5.5.x | |
| AlwaysUV | Yes | |||
Attestation
Enterprise
|
Yes | |||
| Blob Storage | Yes | |||
| Serial Number | Yes | Yes | Yes | Yes |
| YubiHSM Auth | Yes | |||
| CTAP | ||||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
Yes | |||
| Pseudo-Random (PRF) | Yes | |||
| Reset LongTouch | Yes | |||
| Reset Transport | Yes | |||
| Third Party Payment | Yes | |||
| FIDO | ||||
| FIDO2 CTAP 2.3 | Yes | |||
| FIDO U2F | Yes | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 | 25 | 25 |
| FIDO2 PIN Mgmt | Yes | |||
| FIDO2 over CCID | Yes | |||
| Protocols | ||||
| OATH | Yes | Yes | Yes | Yes |
OATH Credential
Storage
|
Yes | |||
| OpenPGP version | 3.4 | 3.4 | 3.4 | |
| OTP | Yes | Yes | Yes | Yes |
| PIV/Smart Card | Multi-
Protocol
|
Multi-
Protocol
|
||
| SCP03 | Multi-
Protocol
|
Multi-
Protocol
|
Multi-
Protocol
|
|
| SCP11 | Multi-
Protocol
|
Multi-
Protocol
5.7.2+
|
||
Security Key Series
The listed firmware versions apply to both Security Key Series and Security Series Enterprise editions.
Security Key Series - Enterprise Edition requires a subscription to YubiKey as a Service. Contact Yubico sales team for information about YubiKey as a Service.
Features
|
Firmware Versions | |||
|---|---|---|---|---|
| 5.8 | 5.7.x | 5.4.x | 5.0.x-5.2.x | |
| AlwaysUV | Yes | Yes | ||
Attestation
Enterprise
|
Enterprise
Edition
|
Enterprise
Edition
|
||
| Blob Storage | Yes | Yes | ||
| Serial Number | Enterprise
Edition
|
Enterprise
Edition
|
Enterprise
Edition
|
|
| YubiHSM Auth | Yes | |||
| CTAP | ||||
CTAP 2.3 Conditional
Mediation,
PPUAT, PCMR
|
Yes | |||
| Pseudo-Random (PRF) | Yes | |||
| Reset LongTouch | Yes | |||
| Reset Transport | Yes | |||
| Third Party Payment | Yes | |||
| FIDO | ||||
| FIDO2 CTAP 2.3 | Yes | |||
| FIDO U2F | Yes | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes | Yes |
FIDO2 Credential
Storage
|
100 | 100 | 25 | 25 |
| FIDO2 PIN Mgmt | Yes | Yes | ||
| FIDO2 over CCID | Yes | |||
| Protocols | ||||
| OATH | Yes | Yes | Yes | Yes |
OATH Credential
Storage
|
Yes | |||
| OpenPGP version | 3.4 | 3.4 | 3.4 | |
| OTP | Yes | Yes | Yes | Yes |
| PIV/Smart Card | Yes | |||
| SCP03 | Enterprise
Edition
|
Enterprise
Edition
|
||
| SCP11 | Enterprise
Edition
|
Enterprise
Edition
5.7.4+
|
||
SCP03, SCP11, Enterprise Attestation, and Serial Number Support are only available on the Security Key Series Enterprise Edition.