YubiKeys Are a Security Gold Standard—but They Can Be Cloned

Researchers disclosed a side-channel cryptographic flaw in the Infineon cryptolibrary used by YubiKey 5 tokens (and potentially other devices using the same microcontroller), enabling cloning and extraction of ECDSA private keys via electromagnetic/timing analysis during modular inversion; devices running firmware prior to 5.7 are permanently vulnerable because firmware cannot be updated on affected tokens, and exploitation requires temporary physical possession and specialized equipment.