YubiKey

YubiKey
Name	YubiKey
Developer	Yubico
Type	Hardware authentication token
Introduced	2008

YubiKey YubiKey is a hardware authentication token produced by Yubico used for strong authentication and credential protection in information systems. It interoperates with a wide range of platforms and services including Microsoft, Google, Apple Inc., GitHub, and Amazon Web Services to provide multi-factor authentication, public key infrastructure support, and passwordless login options. The device competes and cooperates within ecosystems involving RSA (company), Duo Security, Okta, FIDO Alliance, and Fast Identity Online (FIDO) initiatives.

Overview

YubiKey is a small, USB- and NFC-capable security key designed to provide second-factor and passwordless authentication across services such as Dropbox, Salesforce, Slack Technologies, Zoom Video Communications, and WordPress. It supports standards from the FIDO Alliance, including FIDO2, WebAuthn, and protocols adopted by organizations like Mozilla, Google Chrome, Microsoft Edge, and Apple Safari. YubiKey complements enterprise identity solutions from Ping Identity, Auth0, Centrify, and CyberArk while integrating with open-source projects such as OpenSSL, OpenSSH, KeePass, and Linux distributions like Ubuntu.

History and development

YubiKey was developed by the Swedish company Yubico, founded by Stina Ehrensvärd and Jakob Ehrensvärd, amid industry initiatives like the launch of the FIDO Alliance and movements led by firms including Google, Microsoft, and PayPal. Early adoption occurred among security-conscious organizations including Facebook, Twitter, Dropbox, and GitHub following incidents such as high-profile account compromises affecting personalities like Hillary Clinton and entities investigated during inquiries by institutions such as the United States Congress. Yubico collaborated with standards bodies and corporations including NIST, IETF, Microsoft Azure, and Amazon to evolve support for U2F and later FIDO2 credential models.

Design and models

Hardware designs span form factors including USB-A, USB-C, Lightning, and NFC tokens used by consumers and enterprises like Intel, IBM, Dell Technologies, and Cisco Systems. Model lines have included security tokens tailored for Android, iOS, Windows, and macOS deployments and integrate with enterprise directories such as Active Directory and cloud identity services like Okta and Azure Active Directory. Specialized editions address regulated sectors serviced by firms such as Visa, Mastercard, PayPal, and Stripe for payment-authentication workflows and by organizations like World Health Organization and Centers for Disease Control and Prevention for secure access during crisis responses.

Supported protocols and standards

YubiKey implements protocols including FIDO U2F, FIDO2, WebAuthn, OpenPGP, PIV (Personal Identity Verification), and OTP schemes compatible with RFC 6238 and RFC 4226. It interoperates with cryptographic stacks certified under programs run by NIST and aligns with guidance from regulatory bodies like the European Union Agency for Cybersecurity and compliance frameworks used by HIPAA-regulated entities, PCI DSS-compliant merchants, and institutions subject to GDPR enforcement. YubiKey’s support enables integration with software from Mozilla Firefox, Google Chrome, Microsoft Edge, and tooling such as PuTTY and OpenSSH.

Use cases and adoption

Enterprises such as Google LLC, Facebook, Yahoo!, GitLab, and Dropbox have deployed YubiKey devices for account protection, privileged access management, and developer workflow security. Government agencies including US Department of Defense, UK Home Office, and Estonian Government use hardware tokens for personnel authentication and e-government services, while financial institutions like Goldman Sachs, JPMorgan Chase, HSBC, and Deutsche Bank employ them for trader and admin access. Educational institutions such as Harvard University, MIT, and Stanford University adopt hardware tokens for researcher and student identity hardening.

Security considerations

Security analysis discusses resistance to phishing incidents similar to attacks that impacted services used by Sony Pictures Entertainment and Equifax, and evaluates threat models addressed in publications from Bruce Schneier, Charlene M., and standards bodies such as NIST. Hardware tokens reduce risk from credential theft methods highlighted in investigations by US-CERT and academic research from institutions like MIT Computer Science and Artificial Intelligence Laboratory, Stanford University, and Carnegie Mellon University. Considerations include device loss, secure provisioning practices recommended by CISA, supply-chain concerns raised by reports involving vendors like Huawei Technologies and ZTE Corporation, and the need for organizational policies from ISO, PCI Security Standards Council, and regional regulators.

Integration and deployment

Deployment workflows integrate YubiKey with identity providers including Okta, Azure Active Directory, Auth0, and Ping Identity; service providers such as GitHub, Google Workspace, Microsoft 365, and Salesforce; and on-premises systems using LDAP, Active Directory Federation Services, and RADIUS solutions from vendors like Cisco, Fortinet, and F5 Networks. Large-scale rollouts follow best practices from NIST SP 800-63B, guidance by CISA, and implementation patterns used by NASA, European Commission, and multinational corporations such as Siemens and General Electric. Administrators combine YubiKey lifecycle management with asset management tools from ServiceNow and IBM Tivoli to enforce authentication policies and incident response procedures.

Category:Computer security