Yubico Forum

Hello everyone,

I just ordered four replacement Yubikey NEOs and noticed some interesting version numbers. All four keys, when inserted fresh, show up as version "3.4.2" in the YKNeo manager. Three of the yubikeys have serial numbers that start with "35", and one starts with "36". (for comparison, my old YKNeo's start with "30")

After turning on "CCID" mode, I notice that the application version numbers are actually different between the "35xxxxx" and the "36xxxxx" devices: (also showing values for my original devices, for comparison purposes)

SN# 30xxxxx with "Firmware 3.3.0"

• YubiKey OTP v3.3.0
• YubiOATH v0.2.1
• Yubico U2F v1.0.1
• OpenPGP v1.0.8
• Yubico PIV v0.1.2

SN# 35xxxxx with "Firmware 3.4.2"

• YubiKey OTP v3.3.7
• YubiOATH v0.2.1
• Yubico U2F v1.1.0
• OpenPGP v1.0.10
• Yubico PIV v0.1.2

SN# 36xxxxx with "Firmware 3.4.2"

• YubiKey OTP v3.4.1
• YubiOATH v0.2.1
• Yubico U2F v1.1.0
• OpenPGP v1.0.10
• Yubico PIV v0.1.3

So OpenPGP isn't the only application that has changed. We see that the other apps have changed as well:

• YubiKey OTP: v3.3.0 ➔ v3.3.7 ➔ v3.4.1
• Yubico U2F v1.0.1 ➔ v1.1.0
• Yubico PIV v0.1.2 ➔ v0.1.3

What are the changes that were made to each of these apps? I'm specifically interested in what's changed for v0.1.3 of the Yubico PIV app(I really hope it's the ability to make the app behave to spec for NFC), but I'm interested in knowing what else has changed as well.

Ping?

Ping?

I thought I'd check the github site ( https://github.com/Yubico?page=1 ) but couldn't find the applets in question. Not including the abandoned applet repositories (e.g. bitcoin), looks like the github site only hosts the the openpgp and oath applet repositories.

I'm curious as well...
B

request noted.

@brendanhoar: yeah, only OATH and OpenPGP are open source. Everything else is closed source.

I really wish there was an open-source PIV applet out there, but I digress.

I'm glad the request has been noted, although I'm not sure what that means. Does it mean you are asking engineering for the changelog and waiting to hear back from them? Or does it mean "we heard you, stop bumping the thread", but without any specific action being taken to answer my questions?

I'd much rather have an answer like "we can't tell you that", or "we can answer your question specifically in a few months". I mean, I won't like former answer, but at least it's better than no answer at all.

I just got two replacement NEOs and this is what I get reported in NEO Manager.

SN# 36xxxxx with "Firmware 3.4.1"

• YubiKey OTP v3.4.1
• YubiOATH v0.2.1
• Yubico U2F v1.1.0
• OpenPGP v1.0.10
• Yubico PIV v0.1.3

Both are identical except serial number. I also noticed that when CCID is enabled NEO Manager shows firmware 3.4.1 and Personalization Tool shows 3.4.3 but when CCID is disabled both, NEO Manager and Personalization Tool show firmware 3.4.3

Well, they are making changes, that's for sure, although that change was likely minor. It's curious that they aren't keeping the version numbers in sync between the Yubikey OTP app and the actual yubikey API interface.

I'm bumping this thread again because getting "request noted" two weeks ago does not give me any indication that action is being taken to answer my question:

What changed between version 0.12 and 0.13 of the Yubico PIV applet?

SN# 26xxxxx with "Firmware 3.3.0"

• YubiKey OTP v3.3.0
• YubiOATH v0.2.1
• Yubico U2F v1.0.0
• OpenPGP v1.0.7
• Yubico PIV v0.1.2

How do I upgrade to the latest version?

@eminarslan: Please see this post.

@yubico: Ping.