YubiKey firmware 5.8 adds new fields to the authenticatorGetInfo response that let applications discover PIN policy, reset capability, and attestation format support. Reading these fields is a read-only operation: no credentials are created and no PIN or touch is required.
maxPINLength: Maximum PIN length in Unicode code points. There is also a separate 63-byte limit on the UTF-8 wire encoding, so multi-byte characters can hit the byte ceiling before the code-point ceiling. Check both when validating client-side so you can reject a PIN before the authenticator does and give the user a clear error message.
pinComplexityPolicy: Boolean. When true, the authenticator enforces requirements beyond minimum length (e.g. no repeated digits). Query this so you can warn users up front that extra rules apply, instead of letting them hit a vague rejection after they submit.
pinComplexityPolicyURL: Optional URL to a human-readable description of the PIN policy. Independent of pinComplexityPolicy and not guaranteed to be present even when complexity is enabled. When available, link users directly so they know exactly what the authenticator expects.
uvCountSinceLastPinEntry: Number of consecutive UV operations since the authenticator last required PIN entry. Use this to implement "re-enter your PIN after N biometric uses" policies so users don’t go months without typing their PIN and then forget it.
transportsForReset: Array of transports that accept the CTAP reset command. USB-only prevents remote reset over NFC, which stops someone from wiping a key without physical USB access.
longTouchForReset: Boolean. When true, a sustained touch (~5 seconds) is required to confirm factory reset instead of a quick tap. This prevents accidental resets. Your UX needs to tell the user to hold the key, not just tap it, or the reset will fail silently.
attestationFormats: Supported attestation statement formats. Currently packed. This field is future-proofing for when alternate formats (e.g. post-quantum) are standardized. Not much to act on today, but worth logging so you know when that changes.
On firmware older than 5.8, the authenticator omits these CBOR keys from the authenticatorGetInfo response. Client libraries typically fall back to sensible defaults when the keys are absent:
| Field | Typical default when absent |
|---|---|
|
|
|
unset |
|
unset |
|
unset |
|
empty list |
|
|
|
empty list |