Yubico Forum

We've got the question a couple of times - can a Yubikey1 be firmware upgraded to become a Yubikey2 ?

The answer is no, and believe me - there is no business quirk here to force people to buy new hardware.

The Yubikey2 has an entirely new hardware, comprising a different USB chip with a ROM structure. The firmware for Yubikey2 is rewritten from scratch for this completely different USB chip.

But - we have a limited offer where Yubikey1 owners can buy a Yubikey2 at a 40% discount.

With the best regards,

JakobE
Hardware- and firmware guy @ Yubico

Slightly off topic.. I know the V1 keys could not be firmware upgraded at all. Is this limitation the same for the V2 keys? I.e. if you release a fresher 2.x firmware can keys be updated by any means?

Well, actually the other way around. The Yubikey1 can be upgraded by us using some specialized equipment, although we've never taken back keys and upgraded them. The logistical problem of handling it compared with the low value of a single key makes this somewhat meaningless.

The Yubikey2 on the other hand has a ROM structure so updating the firmware is REALLY impossible, i.e. not just a practical limitation

With the best regards,

JakobE
Hardware- and firmware guy @ Yubico

Well I guess at least this means there's no worry of getting malicious firmware put on them

For those of us that weren't paying attention in June and July, is there still an upgrade discount?

Yeah, I bought several of the 1.0 yubikeys for guys here at my office and they arrived the day the 2.0 was announced. How can we take advantage of this upgrade discount, please?

But what about 2.1 -> 2.2? Is it possible to upgrade firmware?

As mentioned earlier in this forum thread, as the Yubikey2 has a ROM structure so updating the firmware is REALLY impossible, i.e. not just a practical limitation.

I"m sure they did this intentionally trying to force people to buy a new key. Which won't happen with me. (yes I know you already stated you didn't do it for this reason).

Well TC93 don't get me wrong but since I first emailed Yubico around Nov 2008 I've been a cynical pain to the staff at Yubico.
And they've been pretty good at considering all points of security and conferring back & forth.

But as for intentional (to generate sales) or not, I prefer ROM over firmware upgrade-ability, because a ROM firmware avoids potential vulnerabilities.
(Vulnerabilities like some kind of an autorun worm/trojan. Such as many sysadmins saw appearing on USB-drives last year...)

In this modern era, ROM chips are still cheaper to produce/buy then a programmable chip that can be used for firmware that is flashed/upgraded.
(Flashed ha! How many of you recall flashing UV across an eeprom window to ready it for reprogramming?)
Now, as I recall the V1 were around $40 each a few years back, I'm sure the ROM chip and higher production quantities have both helped reduce the price to $25 each.

Anyways, I only use my version 1.3.1 Yubikey for logging into these forums and the wiki nowadays.

My Rant:
I'm keeping in mind, that I know someone who purchased a "maxed out" IBM PS/1 PC that he picked up from the store one morning.
He saw on the evening news that the new PS/2 was on sale that afternoon at the very same store, and he wasn't offered anything regarding this "oversight", no discount, no trade option, no apology, no nothing...
So I feel that Yubikey has been fair in offering some discount to V1 key owners.
Besides, how many successful businesses give everything away for free? Even the "NFP" charities must have someone giving them money...