Yubico Replaces Security Keys Due to Hardware Flaws

Yubico Replaces FIPS Series Security Keys Due to Hardware Flaws

Yubico discovered a hardware flaw in YubiKey FIPS Series devices in mid-March and since then, has updated the firmware version to one that does not contain the bug, as well as replaced the majority of affected devices.

  • By Kaitlyn DeHaven
  • Jun 17, 2019

Yubico is replacing U.S. government-approved security keys due to hardware flaws. The recalled device is the YubiKey FIPS Series, which are not consumer devices, and only in versions 4.4.2 and 4.4.4.

Yubico released an advisory last week that stated that the main issue with the security keys was decreased randomness in the first set of values.

“Random values leveraged in some YubiKey FIBS applications contain reduced randomness for the first operations performed after YubiKey FIPS power-up,” Yubico said. “The buffer holding random values contains some predictable content left over from the FIPS power-up self-tests which could affect cryptographic operations which require random data until the predictable content is exhausted.”

Yubico originally discovered the flaw in mid-March 2019, and subsequently created YubiKey FIPS Series firmware version 4.4.5, which achieved FIPS certification on April 30, 2019.

The company has been replacing keys for affected FIPS devices since they discovered the issue, and said that at the time the advisory was released, they believed the majority of affected YubiKey FIPS Series devices had been replaced, or were in the process of being replaced.

The company is not aware of any security breaches due to the issue, but all users that haven’t yet been contacted by Yubico are advised to request a replacement.

About the Author

Kaitlyn DeHaven is the Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Securing the Future

    Two security experts sit down with Security Today’s editor in chief Ralph C. Jensen to discuss what they see emerging and changing over the next several years along with how security stakeholders can harness these innovations into opportunities. Read Now

  • Collaboration Made Easy Using a Work Management Platform

    Effective collaboration between security operators, teams and other departments is critical to the smooth functioning of organizations. Yet, as organizations grow in complexity, it becomes more difficult for teams to coordinate with each other. This is compounded by staffing shortages, turnover and ineffective collaboration tools. Read Now

  • Creating a Safer World

    Managing and supporting locks and door hardware within a facility is a big responsibility. A building’s security needs to change over time as occupancy and use demands evolve, which can make it even more challenging. Read Now

  • Creating More Versatility

    Today, AI has become top of mind for most security professionals. It is the topic of conversation in the technology world and continues to transform the way data is used to make important business decisions. Read Now

Most   Popular

New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.