808bits

YubiKey 4 Cryptographic Module

FIPS 140-2 certificate #3204 · Yubico, Inc. · data as of 2026-09-15

YubiKey 4 Cryptographic Module, from Yubico, Inc., holds FIPS 140-2 certificate #3204 at overall level 2. The validation was revoked. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Revoked. The firmware versions have a security flaw..
Caveat: When operated in FIPS mode. The module generates cryptographic keys whose strengths are modified by available entropy

Certificate

Certificate number3204
StandardFIPS 140-2
Statusrevoked
Overall level2
Module typeHardware
EmbodimentSingle Chip
VendorYubico, Inc. · website
Hardware versionsSLE78CLUFX3000PH
Firmware versions4.4.2, 4.4.4

Module description

Quoted from the NIST CMVP entry for this certificate.

The Yubikey 4 cryptographic module is a secure element that supports multiple protocols designed to be embedded in USB security tokens. The module can generate, store, and perform cryptographic operations for sensitive data and can be utilized via an external touch-button for Test of User Presence in addition to PIN for smart card authentication.The module implements five major functions - Yubico One Time Password (OTP), FIDO Universal 2nd Factor (U2F), PIV-compatible smart card, OpenPGP smart card and OATH OTP authentication.

Security level exceptions

  • Physical Security: Level 3
  • EMI/EMC: Level 3
  • Design Assurance: Level 3
  • Mitigation of Other Attacks: N/A

Approved algorithms (10)

AlgorithmCAVP certificates
AES4712, 4713, 4714
CKGvendor affirmed
CVL1356, 1358, 1360, 1395
DRBG1604
ECDSA1165
HMAC3133, 3134
KTS
RSA2569
SHS3861, 3862
Triple-DES2498

Allowed algorithms

EC Diffie-Hellman (key agreement; key establishment methodology provides 128 or 192 bits of encryption strength); NDRNG

Tested configurations

  • N/A

Validation history

DateTypeLab
2018-06-21InitialUL Verification Services, Inc.
2019-02-07UpdateUL Verification Services, Inc.
2019-04-30UpdateUL Verification Services, Inc.

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status revoked
  • Validation dates on record: 2018-06-21, 2019-02-07, 2019-04-30

Source documents