Update on the use of Yubikeys with ID Austria / xIDENTITY

With immediate effect, FIDO tokens from the manufacturer Yubico can once again be securely linked with the qualified electronic signature (QES) from A-Trust, such as ID Austria and xIDENTITY.

The temporary restriction was due to a recently discovered vulnerability that made it possible to pass off manipulated tokens as authorized devices and create unauthorized links. To eliminate potential risks, A-Trust temporarily deactivated the linking option.

FIDO tokens from the manufacturer Yubico are now available with new firmware (version 5.7), which can be linked to ID Austria and xIDENTITY again; however, it is not possible to update the firmware of affected tokens.

You can check which firmware your Yubikey has on the Yubico website using a check tool.

You can also check which tokens have FIDO2 Level2 certification on the FIDO Alliance website.