To protect against this vulnerability, features have been included in the YubiKey Minidriver to alert users and administrators to potentially vulnerable devices and allow for the option to prevent weak RSA keys from being generated on those YubiKey 4s. This vulnerability concerns the generation of weak keys that may allow the private key to be derived by an attacker in possession of public key. Some YubiKey 4 devices were part of the Infineon RSA key generation vulnerability, CVE-2017-15361, referred to by its discoverers as “Return of Coppersmith’s Attack” (ROCA). Re-issue the certificate template, and once the changes are propagated to connected machines, users should be able to re-enroll their existing YubiKeys. To mitigate this, locate the smart card template for the certificate in question, navigate to the Request Handling tab, and ensure the option Renew with the same key is not selected. With Windows 10, smart card certificate reenrollment will fail if attempting to re-use an existing key when issuing a new certificate. This driver is designed for the YubiKey 4 & 5 which has additional retired slots available for general purpose (82-90), so it will attempt to place a third exchange key in slot 82. Since the YubiKey Minidriver prioritizes assigning slots for keys by smart card usage, it will place the first two authentication keys in slots 9a and 9d during enrollment. The YubiKey NEO has 10120 bytes available for storing Certificate Chain Certificates (root and intermediate certificates). Up to four (4) certificates can be stored concurrently. The YubiKey NEO has a maximum certificate size of 2024 bytes in DER format. The firmware doesn't report how much space allocated to the smart card applet is currently in use. The YubiKey 4 & 5 has 15,260 bytes available for storing Certificate Chain Certificates (root and intermediate certificates). Up to twelve (12) certificates can be stored concurrently.

The YubiKey 4 & 5 has a maximum certificate size of 3052 bytes in DER format. There are storage limitations to consider when loading multiple certificates to the YubiKey: YubiKey 4 & 5 As Yubico receives more feedback from customers, this section will be updated with common questions and fixes. Working with the YubiKey and the YubiKey Minidriver, there are a number of options to help troubleshoot issues with the YubiKey. Preventing Reinstallation after Removal.Previous: YubiKey PIN and PUK User Management on Windows Main Page: YubiKey Smart Card Deployment Guide

Install smart card resource manager