Yubico hackathon to preview YubiKey 5.8 support for next-generation passkeys

Yubico will host a virtual developer hackathon for the FIDO Alliance developer community on August 5 to give developers an early look at the company’s upcoming YubiKey 5.8 firmware release and its support for CTAP 2.3 capabilities.

Participants will receive a limited edition YubiKey 5C NFC running the upcoming 5.8 firmware. They aim to give developers direct access to new FIDO2 capabilities in a hardware authenticator. Developers will be able to experiment with how the updated firmware behaves in practical authentication, identity, and authorization flows.

The device serves as a hardware test to try CTAP 2.3-based features, such as improved credential discovery, better passkey user experiences, fewer PIN prompts, and support for use cases such as hardware-backed signatures, digital wallets, and payment-related authentication.

The bigger significance of YubiKey 5.8 is that it suggests passkeys are moving beyond being a phishing-resistant replacement for passwords. In the most familiar form, passkeys help users sign in securely to websites, applications, and enterprise systems.

But Yubico is positioning the new firmware around a broader set of use cases in which a hardware-backed passkey can confirm if the user is present and has approved a specific action. This could include signing a digital document, authorizing a wallet interaction, approving a payment authentication request, or confirming a sensitive action.

CTAP 2.3 is part of the communication layer that allows a browser, operating system, or application to communicate with a hardware authenticator such as a YubiKey. Yubico says support for CTAP 2.3 and WebAuthn preview signing extensions can allow privacy-capable digital signatures using passkeys, a better autofill passkey experience, and broader enterprise identity provider support.

The WebAuthn signing extensions are important because they allow developers to think of passkeys as more than just a sign-in credential. A login proves that the user controls a credential associated with an account. But a signature can go further by binding user approval to a specific action.

In practice, this could allow a passkey hardware device to confirm that a person approved a document, completed a payment step, or presented their identity. This is why Yubico’s hackathon is relevant for developers working on digital wallets, payments, identity systems, and human-in-the-loop authorization.

EMVCo has recently released a draft framework for Digital Payment Credentials that focuses on setting a consistent schema for structuring these credentials. This could enable payment networks, wallets, and verification systems to handle provisioning, requests, and verification in an interoperable manner. EMVCo says the work covers card-based payment authentication, device binding, cross-domain usage, and dynamic linking.

Yubico and EMVCo developments show that authentication is becoming less isolated from the rest of the digital identity and payment stack. The industry is moving toward cryptographically verifiable credentials.

Article Topics

biometric security key  |  biometrics  |  FIDO Alliance  |  passkeys  |  Yubico