Oh, this is even more complicated -- getting FIPS certification is not a fast process, so the only FIPS-certified Yubikeys at present are the vulnerable ones.

Oh, this is even more complicated -- getting FIPS certification is not a fast process, so the only FIPS-certified Yubikeys at present are the vulnerable ones. Their FIPS 140-3 certificaton process started... huh, yesterday, apparently: https://www.yubico.com/blog/yubico-submits-yubikey-5-fips-series-for-fips-140-3-validation/ https://www.yubico.com/blog/yubico-submits-yubikey-5-fips-se... FIPS certification is never the thing you want if you don't specifically need that certificate number. There are two certified firmware versions, 5.4.2 and 5.4.3, and if you get a FIPS key that's what you're getting. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3907 https://csrc.nist.gov/projects/cryptographic-module-validati...