The YubiKey 4 is a single-chip design without a Java Card/Global Platform environment, featuring RSA with key lengths up to 4096 bits and ECC up to 521 bits.This platform is limited to RSA with key lengths up to 2048 bits and ECC up to 320 bits. There is a clear security boundary between these two chips. There is one “non-secure” USB interface controller and one secure crypto processor, which runs Java Card (JCOP 2.4.2 R1). The YubiKey hardware with its integral firmware has never been open sourced, whereas almost all of the supporting applications are open source.We believe strongly that this benefits the community, as well as Yubico. This includes libraries for interfacing or integrating with our devices, tools used for programming and customization, server software which supports our products, specifications for custom protocols, and many more. We use it daily in the development of new products, and a large portion of our software projects are released as open source software - we have close to 100 projects available on GitHub.

To start off, let me say that Yubico is a strong supporter of free and open source software (FOSS). While open source and security remains central to our mission, we think some clarifications and context around current OpenPGP support would be beneficial to explain what we are doing, why, and how it reflects our commitment to improved security and open source. Recently there have been discussions regarding Yubico’s OpenPGP implementation on the YubiKey 4.

Yubikey open source alternative