In September 2024, NinjaLab researcher Thomas Roche disclosed EUCLEAK (CVE-2024-45678), a side-channel attack against the Infineon cryptographic library used by YubiKey 5 Series devices running firmware earlier than 5.7. The affected implementation had been in use for 14 years and had passed around 80 high-assurance Common Criteria certifications without the flaw being detected.<\/p>\r\n\r\n\r\n\r\n
How it works.<\/strong> When you touch the key to approve a sign-in, the chip performs a mathematical operation using the private key and emits weak electromagnetic signals in the process. An EM probe placed directly against the casing can capture these signals. By analysing them, an attacker can recover the private key that was never supposed to leave the device. In practice, this makes it possible to clone the key without leaving visible damage to the casing.<\/p>\r\n\r\n\r\n\r\nWhat the attacker needs:<\/p>\r\n\r\n\r\n\r\n
\r\nPhysical access to your YubiKey for several minutes. The key must be opened and the casing removed.<\/li>\r\n\r\n\r\n\r\n Specialised side-channel equipment: an oscilloscope, an EM probe, and a workstation. The setup costs at least several thousand dollars.<\/li>\r\n\r\n\r\n\r\n Expertise in side-channel cryptanalysis at the level of a dedicated security researcher.<\/li>\r\n\r\n\r\n\r\n For FIDO2 with user verification, the attacker also needs your PIN or biometric factor.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\nThis is not a scalable attack. It is targeted, expensive, and technically demanding. For most users, the practical risk remains limited. It becomes more relevant when the key protects genuinely critical accounts and an attacker can gain temporary physical access\u2014for example, through a hotel safe, an unattended bag at the office, a customs inspection, or someone with a technical background and access to your workspace.<\/p>\r\n\r\n\r\n\r\n
In firmware 5.7, Yubico replaced the third-party Infineon cryptographic library with its own implementation, which is not affected by EUCLEAK. Older keys cannot be patched because the vulnerable library is embedded in the secure element.<\/p>\r\n\r\n\r\n\r\n
Example.<\/strong> A YubiKey 5C NFC running firmware 5.4.3 is used as the second factor for a work account with access to production servers and a GitHub organisation. You travel for work and leave the key in a hotel safe. That creates a plausible EUCLEAK threat scenario: a sufficiently motivated attacker could clone the key while you are attending a conference. Firmware 5.7+ removes this issue at the hardware level.<\/p>\r\n\r\n[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n
If you use a 5.4.x key as 2FA for critical accounts and EUCLEAK concerns you, the right response is not to panic. Register a new 5.7+ key for 2FA, then remove the old key from those accounts. For most users, there is no need for an urgent replacement.<\/p>\r\n
[\/vc_message]<\/p>\r\n\r\n
Should you replace your key because of EUCLEAK?<\/h3>\r\n\r\n\r\n\r\n A simple rule in information security is to compare the cost of an attack with the value of what it could unlock. EUCLEAK is not a remote exploit. It is a physical, targeted, and expensive operation. The figures below put the risk into context.<\/p>\r\n\r\n\r\n\r\n
Minimum attack budget:<\/strong><\/p>\r\n\r\n\r\n\r\n\r\nEquipment: approximately $11,000 for an oscilloscope, an EM probe, an amplifier, and a workstation.<\/li>\r\n\r\n\r\n\r\n Expertise: a specialist experienced in side-channel cryptanalysis. There are relatively few such specialists, and their time is expensive.<\/li>\r\n\r\n\r\n\r\n Physical access: the attacker must obtain your key without being noticed, open the enclosure, take measurements, and reassemble it. Alternatively, the attacker needs prolonged physical access to the key in laboratory conditions.<\/li>\r\n\r\n\r\n\r\n Time and risk: the operation takes anywhere from several minutes to several hours and carries a risk of detection.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\nA realistic estimate for a single attack\u2014including equipment, specialist time, and the logistics of gaining physical access\u2014is roughly $15,000\u2013$50,000, depending on the scenario.<\/p>\r\n\r\n\r\n\r\n
An attack is economically worthwhile only when the accounts, systems, or assets protected by the key are worth several times more than the attack itself. If an attacker spends $30,000 to clone your key, they expect to gain substantially more.<\/p>\r\n\r\n\r\n\r\n
When you probably do not need to worry<\/h3>\r\n\r\n\r\n\r\n\r\nYou use YubiKey for 2FA on email, social media, GitHub, and similar services without a direct financial component. An attacker is unlikely to spend more than $15,000 to clone a key simply to access your Facebook account.<\/li>\r\n\r\n\r\n\r\n You are an ordinary user with a typical set of accounts. EUCLEAK does not scale: every key must be attacked individually, manually, and with physical access.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\nWhen replacing the key makes sense<\/h3>\r\n\r\n\r\n\r\n\r\nThe key protects an exchange account whose balance is substantially greater than the cost of the attack. If you hold a six-figure amount or more on Binance or another exchange, a targeted attack can become economically rational.<\/li>\r\n\r\n\r\n\r\n The key is used to access production infrastructure, corporate secrets, financial systems, or anything else where a compromise could cost the organisation hundreds of thousands of dollars or more.<\/li>\r\n\r\n\r\n\r\n You are a public figure, journalist, activist, or work in an environment where state or corporate espionage is a realistic threat rather than a hypothetical one.<\/li>\r\n<\/ul>\r\n\r\n[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n
How to assess your risk: ask yourself how much the accounts, systems, and assets protected by the key are worth. If their combined value\u2014including exchange balances, systems access, and reputational damage\u2014is below $50,000, EUCLEAK is likely a theoretical rather than a practical concern. If the value is higher, replacing the key with a 5.7+ model is inexpensive insurance that costs less than $100 and removes the issue entirely.<\/p>\r\n
[\/vc_message]<\/p>\r\n
[vc_message color=”info” message_box_style=”classic” message_box_color=”alert-info” style=”rounded”]Risk model: when does an attack make economic sense? A standard information-security model says that an attack becomes rational when its expected return exceeds its total cost.<\/p>\r\n
Asset value \u00d7 Probability of success > Attack cost + Failure-risk premium.<\/p>\r\n
For EUCLEAK, a realistic estimate is $11,000 for equipment, $5,000\u2013$20,000 for specialist time, and $2,000\u2013$20,000 for the logistics of physical access, for a total of $15,000\u2013$50,000. A skilled attacker might have a 50\u201380% chance of success. The risk premium for detection or prosecution can be modelled as a multiplier of \u00d71.5\u20133, depending on the jurisdiction.<\/p>\r\n
Suppose the total attack cost is $30,000, the probability of success is 60%, and the risk premium is \u00d72. The break-even threshold is $30,000 \/ 0.6 \u00d7 2 = $100,000. In other words, the attack makes economic sense only when the key protects assets worth at least $100,000.<\/p>\r\n
For a lower-cost scenario\u2014$15,000, an 80% probability of success, and minimal risk\u2014the threshold is $15,000 \/ 0.8 \u00d7 1.5 \u2248 $28,000. That is why approximately $50,000 is a reasonable conservative rule of thumb.[\/vc_message]<\/p>\r\n\r\n
Example 1.<\/strong> Suppose you use a YubiKey running firmware 5.4 as the second factor for Gmail, GitHub, and several work services. No financial accounts are protected by the key. Your EUCLEAK risk is close to zero: no one is likely to spend more than $15,000 to access these accounts.<\/p>\r\n\r\n\r\n\r\nExample 2.<\/strong> Suppose a YubiKey running firmware 5.4 protects a Binance account with a balance of more than $200,000. You travel frequently and leave the key in a hotel safe. In this case, the attack may be economically worthwhile for an adversary. Replacing the key with a 5.7+ model for $75 removes this risk entirely.<\/p>\r\n\r\n\r\n\r\nWhich version should you choose today: YubiKey 5.4 or 5.7+?<\/h2>\r\n\r\n\r\n\r\n
For a new purchase, firmware 5.7+ is the clear choice. If you need a key for a regulated environment, choose a YubiKey 5 FIPS Series device with firmware 5.7.4, which is validated under FIPS 140-3. Buying a 5.4 FIPS key for a new deployment makes sense only for specific legacy or previously approved projects.<\/p>\r\n\r\n\r\n\r\n
All new YubiKey 5 Series and Security Key Series devices sold since May 2024 ship with firmware 5.7.x. You can check the version in Yubico Authenticator: the key series and firmware version appear in the upper-left corner of the main screen after the key is connected.<\/p>\r\n\r\n
[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n
Practical advice: if you already own a 5.4.x key and use it for 2FA on email, GitHub, or work services, there is no reason to throw it away in a panic. Review the EUCLEAK section above and assess whether you fall within the relevant risk profile. When buying a new key in 2026, however, choosing 5.4 makes little sense: for the same money, you get fewer slots, a narrower range of cryptographic algorithms, and a theoretical vulnerability that has already been addressed in newer firmware.<\/p>\r\n
[\/vc_message]<\/p>\r\n\r\n
YubiKey 5.4 vs 5.7: key differences at a glance<\/h2>\r\n\r\n\r\n\r\n
\r\nStorage \u2014 100 passkeys instead of 25 and 64 OATH credentials instead of 32. Total capacity increases from 83 to 190 credentials.<\/li>\r\n\r\n\r\n\r\n PIN \u2014 an eight-character minimum, complexity checks enabled by default, CTAP 2.1 with Force PIN Change, and Unicode support.<\/li>\r\n\r\n\r\n\r\n Restricted NFC \u2014 NFC remains disabled until the first USB connection.<\/li>\r\n\r\n\r\n\r\n PIV algorithms \u2014 RSA-3072\/4096, Ed25519, and X25519 were added. Keys can be moved and deleted without resetting the slot.<\/li>\r\n\r\n\r\n\r\n FIPS \u2014 the FIPS 140-2 certification for firmware 5.4.x moved to the Sunset List in May 2026; the YubiKey 5 FIPS Series with firmware 5.7.4 has been validated under FIPS 140-3 since 22 May 2026.<\/li>\r\n\r\n\r\n\r\n EUCLEAK (CVE-2024-45678) \u2014 YubiKey 5 Series devices running firmware earlier than 5.7 can theoretically be cloned through a side-channel attack requiring equipment worth approximately $11,000 or more. Firmware 5.7+ addresses the issue by switching to Yubico\u2019s own cryptographic library. Replace the key if it protects high-value resources; otherwise, an urgent replacement is unnecessary.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\nYubiKey firmware cannot be updated. If you are buying a new key, choose one with firmware 5.7+ and you should not need to think about this again for years.<\/p>\r\n","protected":false},"excerpt":{"rendered":"
How does YubiKey firmware 5.4 differ from 5.7+, and is it worth replacing your key? The hardware looks identical from the outside: USB-A or USB-C, with or without NFC, and the same gold touch sensor. Inside, however, the differences between firmware 5.4.x and 5.7.x are substantial. Before going any further, there is one important point …<\/p>\n","protected":false},"author":10,"featured_media":68557,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1006],"tags":[],"class_list":["post-68586","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-keys"],"_links":{"self":[{"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/posts\/68586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/comments?post=68586"}],"version-history":[{"count":6,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/posts\/68586\/revisions"}],"predecessor-version":[{"id":68600,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/posts\/68586\/revisions\/68600"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/media\/68557"}],"wp:attachment":[{"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/media?parent=68586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/categories?post=68586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lwallet.com.ua\/en\/wp-json\/wp\/v2\/tags?post=68586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"YubiKey](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/07\/blog-yubikey-5.4-vs-5.7-21-07-2026-content-pic2-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\n![\"The](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/07\/blog-yubikey-5.4-vs-5.7-21-07-2026-content-pic4-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\n![\"YubiKey](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/07\/blog-yubikey-5.4-vs-5.7-21-07-2026-content-pic3-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\n![\"YubiKey](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/07\/blog-yubikey-5.4-vs-5.7-21-07-2026-content-pic5-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\n