The main advantage for that is that the private You can either import existing keys you have generated on yourĬomputer or have the YubiKey generate them on board. It can storeĪnd protect different kinds of secrets used for OATH (TOTP, HOTP), U2F, WebAuthn and asymmetricĮncryption like PGP etcetera. What Is A YubiKey?Ī YubiKey is a small device you use over USB or NFC with your computer or mobile phone. Thanks to Klas Lindfors at Yubico for pointing out this in my YubiKey NEO was erroneously mentioned in Yubico’s support article about UPDATE 2020-JAN-08: I’ve striked out YubiKey NEO above since that device never had theĪttestation capability. Organizations can also deploy their own certificates onto theĪffected YubiKeys instead of relying on Yubico’s public key infrastructure (PKI). Yubico has published a custom Python script that can be used to verify The impact for users and organizations is that theĬertificate chain will be deemed invalid by tools that verifies the chain properly, such as OpenSSL Only be solved by a new hardware release. Personal Identity Verification (PIV) attestation feature on YubiKey 4.3 and YubiKey NEO, which could This is the story on how I discovered that Yubico used an invalid certificate chain in their PKI Is Hard - How Yubico Trusted OpenSSL And Got It Wrongīy Laban Sköllermark ( December 30, 2019