These capabilities were introduced in YubiKey firmware 5.8, which implements the major FIDO2 features defined in CTAP 2.2 and CTAP 2.3. The guides explain each capability from a protocol perspective: what it does, why it matters, and how the pieces fit together.
Conditional Mediation for Security Keys
The primitives that support conditional mediation for hardware security keys: Persistent PIN User Access Tokens (PPUAT), the Persistent Credential Management Read-only (PCMR) permission, encIdentifier, and encCredStoreState. Together they let a platform silently recognize a YubiKey, list its discoverable credentials, and populate passkey autofill after a single PIN entry.
Pseudo-Random Function (PRF) Support
Derive a 32-byte hardware-backed secret during credential creation with the hmac-secret-mc extension. On firmware 5.8 this completes in a single user interaction instead of the two required by the original hmac-secret flow.
Sign raw data with hardware-backed keys using the previewSign FIDO2 extension and ARKG (Asynchronous Remote Key Generation). Generate unlimited unlinkable signing keys offline from a single credential, with signatures verifiable by any standard ECDSA library.
Mark a credential for delegated payment use with the thirdPartyPayment extension, optionally paired with credBlob for per-credential metadata and credProtect for user-verification enforcement. Together they provide the authenticator-side pieces for payment confirmation flows such as Secure Payment Confirmation (SPC).
Authenticator Capability Discovery
New authenticatorGetInfo fields in firmware 5.8: PIN policy metadata (maxPINLength, pinComplexityPolicy, pinComplexityPolicyURL, uvCountSinceLastPinEntry), reset capability (transportsForReset, longTouchForReset), and attestationFormats.
Working demos for these features live in the YubicoLabs Build with Us repository, with quickstarts for iOS, Android, .NET, and Python.