Yubico is testing a login key built to withstand quantum computers

On November 3, Yubico opened YubiNation, its first conference for users. The Swedish maker of YubiKey security keys used the occasion to issue a call for applicants. Developers, identity management engineers and teams in charge of certificates can apply to test the next generation of its key, designed for post-quantum cryptography. Spots are limited, and Yubico picks the participants.

The test key includes two algorithms standardized by NIST, the U.S. standards institute: ML-DSA (FIPS 204 standard) for digital signatures and ML-KEM (FIPS 203) for establishing encryption keys. They are meant to withstand a future quantum computer capable of breaking the RSA and elliptic curves used today. Yubico states upfront that this is early access “for testing and evaluation, not for production.” The key is built on a new hardware platform.

A new kind of passkeys and certificates

In practice, the beta can create passkeys, the credentials that replace passwords, signed with ML-DSA. It can also move existing users from classical to post-quantum cryptography. Finally, it generates X.509 certificates for PIV, the strong-authentication standard for cards and keys used notably by the U.S. government, with ML-DSA for signing and ML-KEM for encryption. Yubico provides updated FIDO2 and Java libraries for authentication servers. The maker says the key remains compatible with existing FIDO2, passkey and PIV deployments. According to ID Tech Wire, it has already tested its first implementations with Chrome and Firefox, and sent keys to U.S. federal labs and major cloud providers.

Why it is not yet for your employees

Several obstacles remain. The standards for post-quantum authentication, at the FIDO Alliance, are still being drafted: Yubico says it designed its attestation to evolve with them. FIPS validation, essential for selling to the U.S. government, is not assured. According to ID Tech Wire, Yubico plans to submit the key in about a year, with no date for obtaining it. Above all, according to ID Tech Wire, the firmware of the beta keys cannot be updated: if other algorithms were chosen, the keys would have to be replaced. CEO Jerrod Chong nonetheless speaks of “crypto-agile” hardware, able to keep up with changing standards. The pages reviewed do not say how this promise will apply to future commercial models. Neither a price nor a release date has been announced.

Should you replace your current keys?

Not for now. For authentication, the quantum threat only begins the day a sufficiently powerful quantum computer exists. Encrypted data can be stolen today to be decrypted tomorrow. A login that has already taken place, however, cannot be forged after the fact. Current FIDO2 keys remain excellent protection against phishing. Still, signatures are the most delayed part of the transition, as MITRE noted in October.

For a team that manages its own certificates, this beta is a chance to spot what breaks, from authentication servers to applications that verify signatures. For upcoming purchases, one question is worth asking every vendor: can its keys switch algorithms without being replaced?