Yubico passkeys validated under FIPS 140-3 standard

Yubico, developer of the phishing-resistant authentication technology YubiKey, has announced certification of the next generation of the platform from the US National Institute of Standard Technology. The series of devices has been validated under the Federal Information Processing Standards (FIPS) 140-3 standard.

With the certification, the YubiKey 5 FIPS Series has become the only authenticator authorised by the US Government to hold both Department of Defense public key infrastructure credentials and Fast IDentity Online 2 (FIDO2) passkeys.

The YubiKey 5 FIPS Series supports Zero Trust and modern cybersecurity mandates, and supports larger RSA keys of up to 4096 bits to enhance key management functions and flexibility and align with Department of Defense requirements.

Other security features include restricted NFC usage for NFC-capable keys during transit to prevent manipulation, support for enhanced PIN complexity, and the ability to accommodate up to 100 device-bound passkeys, double the OATH seeds to 64, and 24 PIV certificates.

The series will be made available in a number of form factors, including USB-A, USB-C, NFC, Lightning and Nano, to ensure support for a broad range of laptops, mobile devices and closed-network environments.

Yubico Chief Product and Technology Officer Albert Biketi said with the launch, the company aims to set a new standard for high-assurance authentication that combines government-grade compliance with hardware-backed passkeys.

“YubiKey 5 FIPS Series is the only authenticator authorised by the US Government to hold both DoD PKI credentials and FIDO2 passkeys — giving government and regulated organisations a secure bridge to passwordless,” he said. “With the transition from FIPS 140-2 to FIPS 140-3, government agencies and regulated organisations are moving to a new global standard for cryptographic security — and Yubico is leading this shift with the upgraded YubiKey 5 FIPS Series.”

Image credit: Yubico