Yubico has received FIPS 140-3 validation from the National Institute of Standards and Technology for an upgraded version of its YubiKey 5 FIPS Series, the company’s hardware authenticator targeted at federal and regulated environments. The validation, issued under NIST Cryptographic Module Validation Program certificate number 5291, is the federal standard for cryptographic modules used in non-classified US government systems.
The upgraded YubiKey 5 FIPS Series supports the same range of authentication mechanisms as the broader YubiKey 5 line, including FIDO2 and WebAuthn for phishing-resistant passkeys, Personal Identity Verification smart card credentials, OpenPGP, and OATH one-time passwords. The federal angle is that the validated module is authorized by the US Department of Defense to hold both Department of Defense Public Key Infrastructure credentials and FIDO2 passkeys on the same device, a combination Yubico describes as unique among hardware authenticators.
“YubiKey 5 FIPS Series is the only authenticator authorized by the US Government to hold both Department of Defense PKI credentials and FIDO2 passkeys,” said Albert Biketi, Chief Product and Technology Officer at Yubico. The combination matters for agencies that have run PIV smart card programs for years and are now adding passkeys for systems that do not consume PIV, and for contractors that need to satisfy both sets of requirements on a single piece of hardware.
FIPS 140-3 is the current generation of the US federal cryptographic module standard, replacing FIPS 140-2. The standard sets requirements for the design and implementation of cryptographic modules used by federal civilian and defense agencies, and it is also referenced by regulated industries and several international procurement frameworks. Hardware authenticators that achieve a FIPS 140-3 validation can be deployed into US federal environments and into private-sector buyers that require federally validated cryptography.
The validation lands as federal and regulated buyers continue to move from passwords and SMS-based multi-factor authentication toward phishing-resistant credentials. Yubico has been building out the broader operational model around YubiKey deployment, including partnerships with HYPR and Nametag to embed high-assurance identity verification into the provisioning and recovery lifecycle of the keys.
Sources: Yubico
–
By the ID Tech Editorial Team
