Yubico has released YubiKey 5.8, a firmware update that extends the company’s hardware security keys beyond account authentication into hardware-backed signing and authorization workflows. The release adds support for the CTAP 2.3 protocol and preview support for an emerging WebAuthn signing extension, giving developers standardized tools for building approval, credential and document-signing functions.
The company is positioning the update for workflows in which a user must confirm not only a login but also a specific action. Examples include approving a document, authorizing an AI-assisted business process, presenting a digital credential or confirming a web payment. The cryptographic operation is performed with a physical YubiKey, creating a separate hardware-backed check of the user’s intent.
The distinction separates authentication, which establishes who is accessing a service, from authorization of the transaction that follows. The new functions are intended to let web applications request a hardware-backed signature through familiar browser standards instead of requiring each organization to build and operate a separate cryptographic signing system. Yubico said this approach can support privacy-preserving credentials and human approval steps for automated workflows.
YubiKey 5.8 also supports up to 16 relying-party identifiers for Enterprise Attestation on a single key. That feature allows an organization to identify an individual device across trusted development, testing, staging and production environments while keeping attestation limited to approved services.
Other additions include support for Secure Payment Confirmation and persistent PIN and user-verification authorization tokens. Yubico said the latter can reduce repeated PIN prompts and support credential discovery similar to software-passkey autofill. The release follows Yubico’s recent work on NFC security-key support for Android applications, another effort to make hardware-backed passkeys easier to deploy.
The firmware is generally available across the main YubiKey product families. Yubico’s FIPS Series will remain on firmware 5.7.4 following its FIPS 140-3 validation, and the CCN Series will also stay on 5.7.4 while final recertification continues.
The signing extension remains a preview capability rather than a finalized WebAuthn standard. Developers can begin testing integrations, but production designs will need to account for changes as the specification advances. Existing YubiKey 5.7.4 capabilities are carried into version 5.8.
Sources: Business Wire
–
By the ID Tech Editorial Team
