Zum Inhalt springen
ecdsa.com

YubiKey-PIV-Attestierungs-Verifizierer

Ein YubiKey kann nachweisen, dass ein PIV-Schlüssel in ihm erzeugt wurde und sich nicht exportieren lässt: Er signiert für den Schlüssel ein Attestierungszertifikat mit einem gerätespezifischen Schlüssel, den Yubico zertifiziert hat. Füge die Attestierung und das Gerätezertifikat ein – Kette, Richtlinien und bekannte Sicherheitshinweise zur Firmware werden hier geprüft; die CA-Zertifikate von Yubico sind in die Seite eingebunden.

Attestierungszertifikate werden in diesem Browser-Tab gelesen und geprüft; nichts wird hochgeladen.

ykman piv keys attest 9a attestation.pem
ykman piv certificates export f9 f9.pem

Dieselben Dateien mit yubico-piv-tool: yubico-piv-tool -a attest -s 9a und yubico-piv-tool -a read-certificate -s f9.

Anforderung an die PIN-Richtlinie
Anforderung an die Touch-Richtlinie
Erwarteter Schlüssel und Vertrauensanker (optional)
zum Beispiel der Schlüssel eines CSR, den du gleich signieren willst

Standardmäßig muss die Kette der Attestierung zu den CA-Zertifikaten von Yubico führen, die diese Seite mitbringt: zum Yubico-PIV-Root-Zertifikat, das seit 2016 im Einsatz ist, und zu den 2024 eingeführten Yubico-Attestation-Root- und PIV-Zwischenzertifikaten. Füge andere Root-Zertifikate nur für Testgeräte oder eine private Hierarchie ein.

ersetzen die mitgelieferten Yubico-CAs

Beispiele

Attestierungen mit den Subject-Namen und Yubico-Erweiterungen von YubiKey-5-Geräten, erzeugt von der Testsuite dieser Website aus deterministischen Testschlüsseln (tools/yubikey-attestation-verifier/fixtures/generate.ts). Die Kette dieser Attestierungen führt zu einem Test-Root-Zertifikat, „Example PIV Root CA (test)“, das als eigener Vertrauensanker geladen ist – nicht zu Yubico; deshalb schlägt das Beispiel „geprüft gegen die Yubico-CA“ fehl.

What an attestation proves

A certificate authority that issues certificates for keys on hardware tokens — code signing under the CA/Browser Forum rules, a company's VPN or SSH CA — needs to know that the private key was generated inside the token and cannot leave it. A CSR alone cannot show that: anyone can sign a CSR with a key kept on disk. A YubiKey answers with attestation (Yubico, PIV attestation). On request it issues an X.509 certificate for the public key in a PIV slot, signed by a device attestation key in slot f9. That key's certificate was issued by Yubico at manufacture. The attestation only exists for keys generated on the device; an imported key cannot be attested.

The chain that is checked

  1. Slot certificate ← f9. The attestation certificate (subject YubiKey PIV Attestation 9a for slot 9a) must be signed by the key of the device certificate. The f9 certificate is not a CA certificate, so this link is checked on its own, without CA path rules.
  2. f9 ← Yubico. The device certificate must chain to a Yubico root. Two hierarchies are in use, and both are bundled with the page: the Yubico PIV Root CA that has signed device certificates since 2016, and the Yubico Attestation Root 1 with its PIV attestation intermediates, introduced in 2024. Yubico's published bundle also contains FIDO, OpenPGP and Secure Domain CAs; a PIV attestation must not chain through those, so they are excluded. For a test device or a private hierarchy, paste your own roots under Custom trust anchors.
  3. Consistency. The serial number stated in the slot certificate must equal the one in the device certificate, and the attestation should be within its validity period.

A chain that ends anywhere but at a trusted root means the key may not come from a genuine YubiKey, and the verdict says so.

What the attestation states

Yubico writes the device's properties into extensions under the OID arc 1.3.6.1.4.1.41482.3:

  • Firmware version (.3) — which also decides the advisories below.
  • Serial number (.7) — printed on the key and shown by ykman info; match it against your inventory.
  • PIN and touch policy (.8) — whether the key can be used without the PIN, with it once per session or for every use (and, on the Bio series, with a fingerprint), and whether every use needs a touch, a touch cached for 15 seconds, or none. Set Require a PIN policy and Require a touch policy to turn your own rules into checks: "at least once per session" accepts every use, "at least cached" accepts every use.
  • Form factor (.9) — USB-A or USB-C, keychain or nano, Lightning, Bio; the high bit marks FIPS models.
  • FIPS and CSPN (.10, .11) — certified models.

The slot names follow NIST SP 800-73: 9a PIV authentication, 9c digital signature, 9d key management, 9e card authentication, 82–95 retired key management. If you compare against a CSR you are about to sign, paste its public key or certificate under Expected public key: the attested key must be exactly that key.

Firmware advisories

  • ROCA (CVE-2017-15361, Yubico YSA-2017-01): RSA keys generated by firmware 4.2.6 to 4.3.4 are weak enough that the private key can be computed from the public key. Such an attestation is reported as not valid; the key must be replaced.
  • EUCLEAK (CVE-2024-45678, Yubico YSA-2024-03): ECDSA on firmware before 5.7.0 leaks through a side channel. Exploiting it needs physical access and laboratory equipment, so it is a warning, not a failure.

What stays in your browser

The certificates are parsed and every signature is verified on this page; the Yubico CA certificates come with it, so nothing is fetched and nothing is uploaded. Attestations are public by design — they exist to be shown to whoever must trust the key — so the page can put them into a share link, in the URL fragment that browsers never send to a server. Private keys are refused in every field.

To produce the two files, run ykman piv keys attest 9a attestation.pem and ykman piv certificates export f9 f9.pem, or with yubico-piv-tool, -a attest -s 9a and -a read-certificate -s f9. A CSR made from the same slot can be read in the CSR decoder, and FIDO2 attestations of security keys are a different format, checked by the WebAuthn inspector.