“The EUCLEAK attack requires physical access to the device, expensive equipment, custom software and technical skills.”
The flaw sits in Infineon’s cryptographic library inside the SLE78 secure element, and it went unnoticed for 14 years and about 80 top-level Common Criteria evaluations. Every YubiKey 5 below firmware 5.7 is affected. Yubico moved off Infineon’s library in the 5.7 update of May 6, 2024. Eighty certifications stamped the chip secure without anyone checking whether it ran in constant time.