Firmware: Overview of Features & Capabilities
YubiKeys are programmed in Yubico’s facilities with the latest available firmware and once programmed cannot be updated to another version. The firmware cannot be altered or removed from a YubiKey.
Yubico periodically updates the firmware to take advantage of features and capabilities introduced into the ecosystem.
The firmware version on a YubiKey or an HSM determines whether or not a feature or a capability is available to that device. The quickest and most convenient way to determine your device’s firmware version is to use the YubiKey Manager tool (ykman), a lightweight software package installable on any OS. The YubiKey Manager has both a graphical user interface (GUI) and a command line interface (CLI).
- Download the YubiKey Manager tool: https://www.yubico.com/products/services-software/download/yubikey-manager/
- YubiKey Manager (ykman) CLI & GUI Guide
The features, capabilities, and enhancements of the YubiKey 5 Series that are determined by firmware version are listed below. For full details refer to the technical description sections in this manual.
Overview of Capabilities
YubiKey 5 Series
| Firmware Versions | |||||
|---|---|---|---|---|---|
| Feature/Form Factor | 5.0.x | 5.1.x | 5.2.x | 5.3.x | 5.4.x |
| Serial Number | Yes | Yes | Yes | Yes | Yes |
| OTP | Yes | Yes | Yes | Yes | Yes |
| OATH | Yes | Yes | Yes | Yes | Yes |
| OpenPGP version | 2.1 | 2.1 | 3.4 | 3.4 | 3.4 |
| PIV/Smart Card | Yes | Yes | Yes | Yes | Yes |
| FIDO U2F | Yes | Yes | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes | Yes | Yes |
| YubiHSM Auth | Yes | ||||
| SCP03 | Yes | Yes | |||
| USB-A | Yes | Yes | Yes | Yes | Yes |
| USB-A + NFC | Yes | Yes | Yes | Yes | Yes |
| USB-C | Yes | Yes | Yes | Yes | Yes |
| USB-C + NFC | Yes | Yes | Yes | Yes | |
| USB-A Nano | Yes | Yes | Yes | Yes | Yes |
| USB-C Nano | Yes | Yes | Yes | Yes | Yes |
| Lightning + USB-C | Yes | Yes | Yes |
YubiKey 5 FIPS Series
| Firmware Versions | ||
|---|---|---|
| Feature/Form Factor | 5.4.2 | 5.4.3 |
| Serial Number | Yes | Yes |
| OTP | Yes | Yes |
| OATH | Yes | Yes |
| OpenPGP version | 3.4 | |
| PIV/Smart Card | Yes | Yes |
| FIDO U2F | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes |
| YubiHSM Auth | Yes | |
| SCP03 | Yes | Yes |
| USB-A | Yes | Yes |
| USB-A + NFC | Yes | Yes |
| USB-C | Yes | Yes |
| USB-C + NFC | Yes | Yes |
| USB-A Nano | Yes | Yes |
| USB-C Nano | Yes | Yes |
| Lightning + USB-C | Yes | Yes |
YubiKey 5 CSPN Series
| Feature/Form Factor | Firmware Version 5.4.2 |
|---|---|
| Serial Number | Yes |
| OTP | Yes |
| OATH | Yes |
| OpenPGP version | |
| PIV/Smart Card | Yes |
| FIDO U2F | Yes |
| FIDO2/WebAuthn | Yes |
| YubiHSM Auth | |
| SCP03 | Yes |
| USB-A | Yes |
| USB-A + NFC | Yes |
| USB-C | Yes |
| USB-C + NFC | Yes |
| USB-A Nano | Yes |
| USB-C Nano | Yes |
| Lightning + USB-C | Yes |
YubiKey Bio Series
| Firmware Versions | ||
|---|---|---|
| Feature/Form Factor | 5.5.x | 5.6.x |
| Serial Number | Yes | Yes |
| OTP | ||
| OATH | ||
| OpenPGP version | ||
| PIV/Smart Card | ||
| FIDO U2F | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes |
| YubiHSM Auth | ||
| SCP03 | ||
| USB-A | Yes | Yes |
| USB-A + NFC | ||
| USB-C | Yes | Yes |
| USB-C + NFC | ||
| USB-A Nano | ||
| USB-C Nano | ||
| Lightning + USB-C |
Security Key Series
| Firmware Version | |||
|---|---|---|---|
| Feature/Form Factor | 5.0.x - 5.2.x | 5.4.x | 5.4.x Enterprise Edition |
| Serial Number | Yes | ||
| OTP | |||
| OATH | |||
| OpenPGP version | |||
| PIV/Smart Card | |||
| FIDO U2F | Yes | Yes | Yes |
| FIDO2/WebAuthn | Yes | Yes | Yes |
| YubiHSM Auth | |||
| SCP03 | |||
| USB-A | Yes | ||
| USB-A + NFC | Yes | Yes | Yes |
| USB-C | |||
| USB-C + NFC | Yes | Yes | |
| USB-A Nano | |||
| USB-C Nano | |||
| Lightning + USB-C |
Secure Channel
Secure channel is used for establishing an authenticated and encrypted communication channel over CCID between a host and the secure element on the YubiKey. The YubiKey security domain can store three concurrent long-lived transport key sets.
SCP03 (Secure Channel Protocol 03), which is part of the GlobalPlatform standard, is a framework for mutual authentication and encrypted transport between hosts and secure elements in smart cards. This protocol for secure channel is implemented on YubiKeys as of Yubico 5.4.x firmware.
For an overview of this implementation, see Secure Channel, for detailed descriptions of the secure channel feature refer to Yubico Secure Channel Technical Description, Yubico Secure Channel Key Diversification and Programming, and Yubico SCP03 Developer Guidance.
Note
Applications based on PKCS #11 or Microsoft CNG do not usually use the secure channel.
Security Domains & Key Diversification
The authenticated and encrypted communication channel takes place over the CCID interface between a host and the secure element on the YubiKey. This includes programming or communication from CCID functions. The secure channel feature can therefore be used to load application keys onto the YubiKey to be used with the CCID applications OATH, OpenPGP, or PIV.
Writing CCID Application Keys over SCP03
The YubiKey security domain can store three concurrent transport key sets. A transport key set contains three long-lived AES keys. When a session is established, the session AES keys are derived from the long-lived transport key set.
Key diversification is the process of deriving a secure channel static transport key set from a Batch Master Key (BMK), the YubiKey identifier (part of the device serial number), and additional metadata. Key diversification therefore facilitates secure distribution of key sets over a secure channel. To derive the YubiKey transport key sets, the Batch Master Key (BMK) is shared with the CMS system. If the CMS vendor gives Yubico access to its BMK, Yubico can preprogram the secure channel transport key sets for the YubiKey 5 batches. The BMK could be protected by the YubiHSM2.
In order to import new transport key sets, establish a secure channel with the security domain. Do this with a previously loaded transport key set or the default transport key set. Each secure channel transport key set is protected by being written to the YubiKey security domain in the secure element and stored in a server, typically a CMS system. The host that is accessing the YubiKey has an agent that connects to the CMS system to retrieve the secure channel key set. Based on the secure channel key set, both on the host and the YubiKey, a secure session is established.
Establish SCP03 Secure Channel
Benefits and Usage
- Encryption application keys can be stored on the CMS server as well as on the YubiKey. If the YubiKey is lost or compromised, the encryption key can be recovered and loaded onto a replacement YubiKey.
- Key diversification enables simplified and secured distribution of secure channel transport key sets as only the BMK must be shared with the CMS system to derive the YubiKey transport key sets.
- The secure channel transport key sets can be preprogrammed at the YubiKey batches by Yubico, if the Yubico supply chain has access to the BMK of the CMS vendor.
- The CMS system can generate the secure channel transport key sets based on the YubiKey serial numbers, the BMK, and additional metadata. The CMS can then use the initial secure channel transport key set for writing additional secure channel transport key sets to the YubiKeys.
SCP03 Key Diversification
For more technical information, see Yubico Secure Channel Key Diversification and Programming.
Secure Channel CPLC Data
The Card Production Life Cycle (CPLC) data object is a random dataset that is stored on each YubiKey to assure unique identification of the YubiKeys in CMS. Although it is officially deprecated from the SCP03 standard, it is still widely used to hold card data specific to CMS services or to uniquely identify smart cards. Therefore Yubico has implemented the CPLC data object to provide unique identification of YubiKeys for CMS vendors.
For a more detailed description of CPLC data object, see Secure Channel CPLC Data.
PIV Enhancements
YubiKey PIV Metadata
YubiKey 5 PIV metadata enables services and client software to obtain information about PIV keys from a central location, this means it is no longer necessary to query PIV attestation. This enables the YubiKey PIV application to report on characteristics of cryptographic keys in the specified PIV slot. YubiKey PIV metadata thereby facilitates integration with CMS vendors.
PIV metadata is available as of YubiKey 5.3.0 firmware. For details, see the Get Metadata section of the PIV extensions.
PIV Management Key (AES)
Prior to the release of the 5.4.2 firmware, the PIV management key was a 3DES key. This feature expands the management key type held in PIV slot 9b to include AES keys (128, 192 and 256) as defined in SP 800-78-4 Cryptographic Algorithms and Key Sizes for Personal Identity Verification <SP800-78-4, section 5). The PIV management key in AES format enables current and future FIPS-compliant CMS services.
For additional technical information, see PIV AES Management Key.
NFC ID: Calculation Changed
Crucial to vendors of physical access control systems and door protection systems utilizing NFC readers, the modification of the YubiKey NFC ID calculation enables NFC readers and access management systems (door locks) using the NFC ID tag to identify NFC-enabled YubiKeys, including those without serial numbers. It is now calculated so that a unique string is returned in the first part of the NFC ID. Until the release of the 5.4.2 firmware, the fact that some access control systems truncate the YubiKey NFC ID meant that YubiKey 5 NFC IDs appeared to be non-unique.
For more technical information on this, see NFC ID Calculation Technical Description.
YubiHSM Auth
YubiHSM Auth is a YubiKey CCID application that stores the long-lived credentials used to establish secure sessions to a YubiHSM 2. The secure session protocol is based on Secure Channel Protocol 3 (SCP03), see Yubico Secure Channel Technical Description. YubiHSM Auth is supported by YubiKey firmware version 5.4.3.
For more details, see YubiHSM Auth.
YubiHSM Auth is a CCID application that can store long-lived credentials (AES keys) that are used to establish secure sessions to a YubiHSM 2. By providing an external challenge, a derivation scheme that yields three session keys is executed. The session keys are not stored on the YubiKey but simply output as a result. The session keys can be used for authentication to the YubiHSM 2. The authentication scheme is based on SCP03 (see Secure Channel above). Each long-lived YubiHSM Auth credential is protected by a user access code that has to be provided to authenticate each session. Storing and deleting credentials requires a separate admin access code.
Benefits and Usage
YubiHSM Auth enables the secure storage of the long-lived credentials for accessing a YubiHSM 2. The existing authentication solution for the YubiHSM 2 is based on software credentials derived from the Password-Based Key Derivation Function 2 (PBKDF2) algorithm with a password as input.
Generating keys using PBKDF2 is just for convenience. It is preferable - and recommended - to provide AES keys directly to avoid exposing them to attack. Not only is it important to avoid losing the derivation password or the keys themselves (as those are basically the same thing), but those credentials also
- Exist outside a secure element and
- Need to be given in clear text to the program that uses them loads them into memory.
With YubiHSM Auth only the ephemeral session keys exist outside a secure environment.
For more details, see YubiHSM Auth.
Click for Yubico Support.