{"product_id":"yubihsm-2-fips","title":"YubiHSM 2 FIPS","description":"\u003cp\u003e\u003cb\u003eYubiHSM 2 FIPS\u003c\/b\u003e is a nano-sized hardware security module (HSM) with a USB-A connector. It keeps your digital signing and encryption keys in hardware instead of as files on a server. This model is validated to \u003cb\u003eFIPS 140-3 Level 3\u003c\/b\u003e.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eGovernment agencies, and organizations working for government that require FIPS-standard HSMs\u003c\/li\u003e\n\u003cli\u003eBanks, insurers, securities firms, and other financial service providers\u003c\/li\u003e\n\u003cli\u003eRegulated or audited organizations that must show critical keys are stored in a validated device\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eIf your organization has no FIPS requirement, see the standard \u003ca href=\"\/en\/products\/yubihsm-2\"\u003eYubiHSM 2\u003c\/a\u003e.\u003c\/p\u003e\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eProtecting root CA and internal CA keys, including Microsoft Active Directory Certificate Services\u003c\/li\u003e\n\u003cli\u003eSigning and verifying digital signatures\u003c\/li\u003e\n\u003cli\u003eCode and firmware signing\u003c\/li\u003e\n\u003cli\u003eFile and database encryption\u003c\/li\u003e\n\u003cli\u003eIoT gateways, manufacturing, and supply chain\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eFIPS 140-3 validation\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNIST Cryptographic Module Validation Program (CMVP) certificate \u003cb\u003e#5302\u003c\/b\u003e, status Active\u003c\/li\u003e\n\u003cli\u003eOverall \u003cb\u003eLevel 3\u003c\/b\u003e\n\u003c\/li\u003e\n\u003cli\u003eTested firmware version: \u003cb\u003e2.4.1\u003c\/b\u003e\n\u003c\/li\u003e\n\u003cli\u003eValidated June 3, 2026; sunset date June 2, 2031\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eAlgorithms\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRSA 2048, 3072, and 4096 bit; signing with PKCS#1 v1.5 and PSS, decryption with PKCS#1 v1.5 and OAEP\u003c\/li\u003e\n\u003cli\u003eECC on curves secp224r1, secp256r1, secp256k1, secp384r1, secp521r1, bp256r1, bp384r1, bp512r1, and curve25519, with ECDSA, ECDH, and EdDSA (curve25519 only)\u003c\/li\u003e\n\u003cli\u003eSHA-1, SHA-256, SHA-384, and SHA-512\u003c\/li\u003e\n\u003cli\u003eAES-CCM key wrap at 128, 192, and 256 bits\u003c\/li\u003e\n\u003cli\u003eHardware true random number generator (TRNG) seeding an AES-256 CTR_DRBG per SP 800-90\u003c\/li\u003e\n\u003cli\u003eAttestation that a key pair was generated on the device\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eCapacity and management\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e256 object slots, 128 KB total; up to 127 RSA-2048, 93 RSA-3072, or 68 RSA-4096 keys, or 255 EC keys (with one authentication key)\u003c\/li\u003e\n\u003cli\u003e16 concurrent sessions; can be shared over the network and managed remotely\u003c\/li\u003e\n\u003cli\u003eM of N wrap key backup and restore\u003c\/li\u003e\n\u003cli\u003eRole-based access control by domain\u003c\/li\u003e\n\u003cli\u003eHash-chained, signed audit log\u003c\/li\u003e\n\u003cli\u003eVersion 2.4 adds asymmetric backup wrapping and BYOK support\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eIntegration\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMicrosoft CNG via the YubiHSM Key Storage Provider (KSP)\u003c\/li\u003e\n\u003cli\u003ePKCS#11 on Windows, Linux, and macOS\u003c\/li\u003e\n\u003cli\u003elibyubihsm library for C and Python\u003c\/li\u003e\n\u003cli\u003eYubiHSM Shell, YubiHSM Connector, and YubiHSM Setup Tool\u003c\/li\u003e\n\u003cli\u003eOpen source SDK\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eWorks with Windows, Windows Server, Linux, and macOS. Check the manufacturer's documentation for supported operating system versions before installing.\u003c\/p\u003e\n\u003ch3\u003eThe device\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNano form factor with a USB-A connector, designed for internal or confined USB ports\u003c\/li\u003e\n\u003cli\u003e12 x 13 x 3.1 mm, 1 g\u003c\/li\u003e\n\u003cli\u003eUSB 1.x Full Speed (12 Mbit\/s); 20 mA average, 30 mA maximum\u003c\/li\u003e\n\u003cli\u003eIP68 water and dust resistant, crush resistant, no battery\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eFAQ\u003c\/h3\u003e\n\u003cp\u003e\u003cb\u003eHow is it different from the standard YubiHSM 2?\u003c\/b\u003e\u003cbr\u003eSpecifications and operation are nearly identical. The FIPS model is validated to FIPS 140-3 Level 3 under certificate #5302, so it suits work where a contract or policy requires a validated HSM. Without that requirement, the standard model does the same job.\u003c\/p\u003e\n\u003cp\u003e\u003cb\u003eWhere can I verify the certificate?\u003c\/b\u003e\u003cbr\u003eLook up certificate 5302 on the \u003ca href=\"https:\/\/csrc.nist.gov\/projects\/cryptographic-module-validation-program\/certificate\/5302\" target=\"_blank\" rel=\"noopener\"\u003eNIST CMVP website\u003c\/a\u003e. The Security Policy document can be downloaded from the same page.\u003c\/p\u003e\n\u003cp\u003e\u003cb\u003eAre other connectors available?\u003c\/b\u003e\u003cbr\u003eNo. It comes in one version only: nano form factor with a USB-A connector.\u003c\/p\u003e\n\u003ch3\u003eCorporate purchasing\u003c\/h3\u003e\n\u003cp\u003eUse the \u003cb\u003eRequest a price\u003c\/b\u003e button on this page for a quote and lead time, or email order@siambc.com.\u003c\/p\u003e","brand":"Yubico","offers":[{"title":"Default Title","offer_id":50903151706369,"sku":"YBHSM2FIPS","price":0.0,"currency_code":"THB","in_stock":false}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0729\/2056\/3969\/files\/yubihsm-2-fips-back.jpg?v=1792549250","url":"https:\/\/siambc.com\/en\/products\/yubihsm-2-fips","provider":"SIAMBC","version":"1.0","type":"link"}