Keys for Yubico smart cards (2024)

This section provides information you need when setting up keys for Yubico cards.

Note: Information about default keys for YubiKey 5 cards is available from the YubiKey 5 Series Technical Manual

10.2.1 Cryptographic keys for Yubico cards

When you configure the cryptographic keys, use the following details:

YubiKey SC and YubiKey SC FIPS devices may be provided in two different configurations, one with static factory keys, and the other with diverse factory keys.

10.2.2 Setting up the PIV PUK key

The PIV PUK diversifies the PUK / SOPIN. If the devices are provided to you with factory keys that are diversified, you can configure the keys in the Key Manager workflow.

If no factory keys are configured, MyID uses the default PUK 12345678.

To configure a factory PIV PUK key:

1. From the Configuration category, select the Key Manager workflow.
2. From the Select Key Type to Manage drop-down list, select PIV PUK.
3. Click Next.
4. Click Add New Key.

5. Set the following values:

   • Credential Type: YubiKey SC or YubiKey SC FIPS
   • Key Type: Factory
   • Key Diversity: DiverseYB108
   • Encryption Type: AES256

6. Enter the Encryption Key.

   If required, you can use a key ceremony; select Use Key Ceremony, click Enter Keys, and provide the key in multiple parts. Alternatively, click Import Keys and select a file containing the key ceremony data; see the Entering keys using a key ceremony section in the Administration Guide for details.

7. Click Save.

If required, you can also configure customer keys in the Key Manager workflow. If no customer keys are configured, MyID applies the Security Officer PIN Type configuration (on the Device Security page of the Security Settings workflow) which can be Factory or Random.

To configure a customer PIV PUK key:

1. From the Configuration category, select the Key Manager workflow.
2. From the Select Key Type to Manage drop-down list, select PIV PUK.
3. Click Next.
4. Click Add New Key.

5. Set the following values:

   • Credential Type: YubiKey SC or YubiKey SC FIPS
   • Key Type: Customer
   • Key Diversity: DiverseYB108
   • Encryption Type: AES256

6. Select one of the following options:

   • Automatically Generate Encryption Key in Software and Store on Database – the key is automatically generated and stored in the database.

   • Encryption Key – type the key into the box. Optionally, you can include the KeyChecksum Value.

   • Automatically Generate Encryption Key on HSM and Store on HSM – this option generates a key on the HSM.

     Note: The HSM options appear only if your system is configured to use an HSM.

   • Existing HSM Key Label – if you have an existing key on your HSM that you want to use, type its label.
   • Use Key Ceremony – click Enter Keys and provide the key in multiple parts. Alternatively, click Import Keys and select a file containing the key ceremony data; see the Entering keys using a key ceremony section in the Administration Guide for details.
7. Click Save.

10.2.3 Setting up the Configuration Lock Code

The Configuration Lock Code locks the configuration of the supported interfaces. If the devices are provided to you with factory keys that are diversified, you can configure the keys in the Key Manager workflow.

If no factory keys are configured, MyID will assume the interfaces are not secured out of the factory.

To configure a factory Configuration Lock Code key:

1. From the Configuration category, select the Key Manager workflow.
2. From the Select Key Type to Manage drop-down list, select Configuration Lock Code.
3. Click Next.
4. Click Add New Key.

5. Set the following values:

   • Credential Type: YubiKey SC or YubiKey SC FIPS
   • Key Type: Factory
   • Key Diversity: DiverseYB108
   • Encryption Type: AES256

6. Enter the Encryption Key.

   If required, you can use a key ceremony; select Use Key Ceremony, click Enter Keys, and provide the key in multiple parts. Alternatively, click Import Keys and select a file containing the key ceremony data; see the Entering keys using a key ceremony section in the Administration Guide for details.

7. Click Save.

If required, you can also configure customer keys in the Key Manager workflow. If no customer keys are configured, MyID will not change the factory key (if configured) or will not secure the interface configuration (if no factory key is configured).

To configure a customer PIV PUK key:

1. From the Configuration category, select the Key Manager workflow.
2. From the Select Key Type to Manage drop-down list, select Configuration Lock Code.
3. Click Next.
4. Click Add New Key.

5. Set the following values:

   • Credential Type: YubiKey SC or YubiKey SC FIPS
   • Key Type: Customer
   • Key Diversity: DiverseYB108
   • Encryption Type: AES256

6. Select one of the following options:

   • Automatically Generate Encryption Key in Software and Store on Database – the key is automatically generated and stored in the database.

   • Encryption Key – type the key into the box. Optionally, you can include the KeyChecksum Value.

   • Automatically Generate Encryption Key on HSM and Store on HSM – this option generates a key on the HSM.

     Note: The HSM options appear only if your system is configured to use an HSM.

   • Existing HSM Key Label – if you have an existing key on your HSM that you want to use, type its label.
   • Use Key Ceremony – click Enter Keys and provide the key in multiple parts. Alternatively, click Import Keys and select a file containing the key ceremony data; see the Entering keys using a key ceremony section in the Administration Guide for details.
7. Click Save.