Yubico Announces Upgraded YubiKey 5 FIPS Series, Now FIPS 140-3 Validated

Key Terms

fido2 technical

FIDO2 is an industry standard that lets websites and apps replace passwords with stronger methods such as hardware security keys, device PINs or built‑in biometrics (fingerprint/face) through your browser or phone. For investors, adoption matters because it reduces the chance and cost of account breaches, improves customer trust and regulatory alignment, and can influence a company’s operating costs and market value—like upgrading from a shared house key to individual fingerprint locks.

pki technical

PKI (Public Key Infrastructure) is a system that creates and manages digital “keys” and electronic certificates to prove identities and secure online communications, like a bank vault and ID card for data. For investors, PKI matters because it helps prevent fraud, ensures that financial documents and trading instructions are genuine, and reduces regulatory and operational risk tied to hacked accounts or tampered disclosures.

openpgp technical

OpenPGP is an open standard for encrypting and digitally signing electronic messages and files so only intended recipients can read them and recipients can verify who sent them. Think of it as a system of locked boxes and matching keys: one key locks a message for privacy, and another verifies the sender’s identity; this matters to investors because it helps protect sensitive corporate information, prevents spoofed announcements, and reduces fraud and compliance risk.

oath otp technical

An OATH OTP is a one-time password created according to an open authentication standard (OATH) used to confirm a user’s identity during login or a transaction. Think of it as a disposable key that changes every minute or after each use, so even if someone sees it once, they can’t reuse it; this boosts investor protection for account access and sensitive actions.

webauthn technical

WebAuthn is a web standard that lets websites replace passwords with a digital ‘key’ stored on your device or a security token, so a site can verify you without ever asking for a password. For investors, widespread WebAuthn adoption can lower breach risk and fraud costs, improve user trust and conversion, and reduce regulatory and remediation expenses—similar to a stronger, personalized lock that cuts the chance of a costly break-in.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

YubiKey 5 FIPS Series uniquely recognized in DoD guidance for hardware-based FIDO2 passkeys, bridging modern authentication with existing identity systems

SANTA CLARA, Calif. & STOCKHOLM--(BUSINESS WIRE)-- Regulatory News:

Yubico (NASDAQ STOCKHOLM: YUBICO), the pioneer of phishing-resistant authentication and creator of the most secure hardware-backed passkey, the YubiKey, today announced the certification of the next generation of its YubiKey 5 FIPS Series – now FIPS 140-3 validated with Certificate #5291. Published by the National Institute of Standards and Technology (NIST), this milestone represents the latest evolution in cryptographic module validation and reinforces Yubico’s leadership in delivering hardware-backed phishing-resistant authentication. The YubiKey 5 FIPS Series supports Zero Trust and modern cybersecurity mandates, and is trusted by governments, defense organizations and the world’s most security-conscious enterprises.

“Yubico is setting a new standard for high-assurance authentication, combining government-grade compliance with hardware-backed passkeys,” said Albert Biketi, chief product and technology officer at Yubico. “YubiKey 5 FIPS Series is the only authenticator authorized by the U.S. Government to hold both DoD PKI credentials and FIDO2 passkeys – giving government and regulated organizations a secure bridge to passwordless. With the transition from FIPS 140-2 to FIPS 140-3, government agencies and regulated organizations are moving to a new global standard for cryptographic security – and Yubico is leading this shift with the upgraded YubiKey 5 FIPS Series.”

For organizations responsible for protecting sensitive information – including U.S. federal agencies, defense contractors and regulated industries – transitioning to FIPS 140-3 is a foundational requirement to maintain compliance and security assurance. As the only authenticator authorized by the U.S. Department of Defense to hold both DoD PKI credentials and FIDO2 passkeys, this unique dual capability simplifies deployments while strengthening phishing-resistant security – allowing organizations to leverage a single hardware device to support FIDO2/WebAuthn, PIV/Smart Card authentication, OpenPGP and OATH OTP.

The FIPS 140-3 framework aligns closely with the international ISO/IEC 19790:2012 cryptographic standard, helping global enterprises and government agencies adopt a unified, modern security baseline across their operations. The upgraded YubiKey 5 FIPS Series meets FIPS 140-3 Overall Level 2, with Physical Security Level 3 – providing high-assurance authentication designed for the most demanding security environments. Additionally, the devices enable compliance with NIST SP 800-63B Authenticator Assurance Level 3 (AAL3) requirements.

Powerful Enterprise-Grade Features for Regulated Environments

Featuring the latest YubiKey 5.7.4 firmware, the YubiKey 5 FIPS Series addresses high assurance enterprise authentication requirements, spanning PKI and modern passkey use cases.

• Expansion and Enhancement of Public Key Algorithms: Support for larger RSA keys (RSA-3072 and RSA-4096) and Ed25519, enhancing key management functions and flexibility for organizations – aligning with DoD memo requirements on stronger public key algorithms.
• Restricted NFC Usage During Transit: NFC capable YubiKeys have restricted NFC usage to prevent manipulation during transit.
• Enhanced PIN Complexity: Enabled by default across all YubiKey applications, including FIDO2, PIV and OpenPGP.
• FIDO Client to Authenticator Protocol (CTAP) 2.1 implementation: Improvements around the FIDO2 PIN, including Force PIN Change and Minimum PIN Length – addressing PIN requirements in “enroll on behalf” scenarios.
• Expanded Passkey and Passwordless Storage Capabilities: Accommodating up to 100 device-bound passkeys (up from 25), 64 OATH seeds (up from 32) and 24 PIV certificates.
• Enterprise Attestation: Facilitates the retrieval of unique identifiers during FIDO2 registration and streamlining asset tracking by allowing identity providers to read the serial number from the YubiKey during FIDO2 registration.
• New secure channel protocol: The addition of SCP11, which is based on asymmetric cryptography.

The YubiKey 5 FIPS Series will be available in a wide range of form factors – including USB-A, USB-C, NFC, Lightning and Nano – ensuring seamless compatibility across modern laptops, mobile devices and secure closed-network environments.

For more information on the YubiKeys 5 FIPS Series and 140-3 Validation, read Yubico’s blog here or visit: https://www.yubico.com/products/yubikey-fips/

About Yubico

Yubico (Nasdaq Stockholm: YUBICO) is a modern cybersecurity company on a mission to make the digital world safer for everyone. As the inventor of the YubiKey, we set the gold standard for modern phishing-resistant, hardware-backed authentication, stopping account takeovers and making secure login simple.

Since 2007, we’ve helped shape global authentication standards, co-created FIDO2, WebAuthn, and FIDO U2F, and introduced the original passkey. Today, our passkey technology secures people and organizations in over 160 countries—transforming how digital identity is protected from onboarding to account recovery.

Trusted by the world’s most security-conscious brands, governments, and institutions, YubiKeys work out of the box with hundreds of apps and services, delivering fast, passwordless access without friction or compromise.

We believe strong security should never be out of reach. Through our philanthropic initiative, Secure it Forward, we donate YubiKeys to nonprofits supporting at-risk communities.

Headquartered in Stockholm, Sweden; Santa Clara, California; and Singapore, Yubico is proud to be recognized as one of TIME’s 100 Most Influential Companies and Fast Company’s Most Innovative Companies. Learn more at www.yubico.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260526217181/en/

Yubico
Yubico Communications Team
press@yubico.com

Source: Yubico