YubiKey 5.8 brings hardware-backed authorization to passkeys

Yubico has launched YubiKey 5.8 to expand the role of its hardware-backed passkeys to support digital signatures and authorization workflows.

The firmware adds support for CTAP 2.3 and introduces capabilities for applications such as identity wallets, document signing, and high-assurance workflow approvals.

Previously, we covered the upcoming firmware ahead of YubiKey’s August developer hackathon.

One of the major changes is developer preview support for the WebAuthn signing extension.

Passkeys already use cryptographic signatures to authenticate users, but the new capability allows applications to request hardware-backed signatures for other digital actions.

The proposed extension creates a different signing key which allows applications to use hardware-backed cryptography without changing the underlying authentication credential into a general-purpose signing key.

Yubico says this could allow developers to use familiar FIDO and WebAuthn interfaces for document signing, digital credentials, and workflow approvals.

Yubico is also positioning the capability around human authorization of actions initiated by AI agents.

For example, an employee may be authenticated to an enterprise system while an AI agent operating on their behalf attempts a higher-risk task.

Yubico gives the example of requiring physical interaction with a YubiKey before an automated workflow can change a production database to make an additional hardware-backed approval step.

The signing capability creates another challenge when YubiKeys are used for digital identity. If the same public signing key is repeatedly used for different organizations, the key can become a persistent identifier.

YubiKey 5.8 addresses this with developer preview support for Asynchronous Remote Key Generation (ARKG), a cryptographic mechanism that generates multiple public keys without exposing or accessing the corresponding private keys.

Yubico is combining ARKG with its new previewSign extension so that applications can generate unlinkable signing keys associated with a hardware-backed credential.

Alongside the new signing capabilities, YubiKey 5.8 includes changes that make hardware-backed passkeys easier to use and manage across enterprise environments.

Hardware security keys provide stronger isolation than passkeys, but can introduce friction, such as users may need to connect or tap the key, enter its PIN, and then locate the correct credential stored on it.

YubiKey 5.8 implements CTAP 2.3, which brings a similar credential discovery experience to external security keys.

One of the underlying mechanisms is Persistent PIN/User Verification Auth Tokens (PPUAT), introduced in CTAP 2.2 and supported as part of Yubico’s CTAP 2.3 implementation.

A PPUAT allows a platform to retain a restricted authorization token after the user verifies themselves with the YubiKey PIN.

For the user, the result resembles the autofill experience associated with software passkeys. Yubico says the change can make credential discovery more intuitive while reducing the authentication friction associated with moving among multiple applications.

The change is important for enterprise deployment because phishing resistance is one part of passkey adoption.

“YubiKey 5.8 represents one of the most significant architectural updates to the modern authentication ecosystem by expanding phishing resistance into the workflows themselves,” says Albert Biketi, chief product and technology officer at Yubico.

YubiKey 5.8 also expands Enterprise Attestation, which addresses a different problem of how an organization can identify and manage the individual hardware keys it has issued.

The Enterprise Attestation implementation allows predefined relying parties, such as an organization’s identity provider, to obtain the serial number of a YubiKey when a FIDO2 credential is registered.

This gives the organization a way to associate a particular credential enrollment with a specific managed device. Yubico notes that the capability requires support from both the relying party or identity provider and the client platform.

YubiKey 5.8 increases the number of relying party IDs that can be configured for Enterprise Attestation from two to 16 on a single key.

Yubico says this allows the same YubiKey to be identified across a larger number of trusted development, testing, staging, and production environments and across multiple identity providers.

YubiKey 5.8 is now shipping across Yubico’s major product lineups. The YubiKey FIPS Series remains on firmware 5.7.4 to maintain its FIPS 140-3 regulatory alignment.

Article Topics

biometric security key  |  enterprise  |  passkeys  |  passwordless authentication  |  Yubico