Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

    Projects Cryptographic Module Validation Program Validated Modules Search

Cryptographic Module Validation Program CMVP

Certificate #5291

Details

Module Name
YubiKey 5 Cryptographic Module
Standard
FIPS 140-3
Status
Active
Sunset Date
5/21/2031
Overall Level
2
Caveat
When operated in approved mode; When installed, initialized and configured as specified in Section 11.1 of the Security Policy; No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.
Security Level Exceptions
  • Operational environment: N/A
  • Physical security: Level 3
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Module Type
Hardware
Embodiment
SingleChip
Description
The YubiKey 5 Cryptographic Module (the module) is a single-chip module validated at FIPS 140-3 Security Level 2. The module is a secure element that supports multiple protocols designed to be embedded in USB and/or NFC security tokens. The module can generate, store, and perform cryptographic operations for sensitive data and can be utilized via an external touch-button for Test of User Presence in addition to PIN for smart card authentication. The module implements several major functions - FIDO, PIV-compatible smart card, OpenPGP smart card, OATH authentication, Security Domain, and YubiHSM Auth.
Approved Algorithms
AES-CBC
A5891
AES-CCM
A5891
AES-CMAC
A5891
AES-ECB
A5891
Counter DRBG
A5891
ECDSA KeyGen (FIPS186-5)
A5891
ECDSA SigGen (FIPS186-5)
A5891
ECDSA SigVer (FIPS186-5)
A5891
EDDSA KeyGen
A5891
EDDSA SigGen
A5891
EDDSA SigVer
A5891
HMAC-SHA-1
A5891
HMAC-SHA2-256
A5891
HMAC-SHA2-384
A5891
HMAC-SHA2-512
A5891
KAS-ECC-SSC Sp800-56Ar3
A5891
KDA HKDF SP800-56Cr2
A5891
KDF ANS 9.63
A5891
KDF SP800-108
A5891
RSA Decryption Primitive Sp800-56Br2
A5891
RSA KeyGen (FIPS186-5)
A5891
RSA SigGen (FIPS186-5)
A5891
RSA Signature Primitive
A5891
RSA SigVer (FIPS186-5)
A5891
SHA-1
A5891
SHA2-256
A5891
SHA2-384
A5891
SHA2-512
A5891

Vendor

Yubico, Inc.
5201 Great America Parkway
ste 122
Santa Clara, CA 95054
United States

FIPS certification team
[email protected]
Phone: 1-650-285-0088

Related Files

Security Policy
Consolidated Certificate

Validation History

Date Type Lab
5/22/2026 Initial Penumbra Security, Inc.