Yubico has announced the general availability of YubiKey 5.8, a firmware update it says is designed to extend passkeys beyond user authentication into hardware-backed authorisation for workflows such as digital signatures, identity wallets and approvals involving AI-driven agents.
The company said the release is aimed at organisations trying to control not only who can access systems, but what actions users or autonomous agents can take as generative and agentic AI increase the speed and scale of cyberattacks.
“YubiKey 5.8 represents one of the most significant architectural updates to the modern authentication ecosystem by expanding phishing resistance into the workflows themselves,” said Albert Biketi, chief product and technology officer at Yubico. “In an era where AI agents execute high-consequence business workflows, organisations must enable dynamic verification of human intent. YubiKey 5.8 bridges that gap, bringing hardware-backed phishing resistance directly into digital signatures, enterprise credential management, and human-in-the-loop validation workflows – without requiring costly custom cryptographic rollouts.”
Yubico said YubiKey 5.8 introduces support for the CTAP 2.3 standard and offers preview support for an emerging WebAuthn signing extension, aimed at enabling developers to build signing and approval workflows using existing standards and APIs.
According to the company, updates include expanded Enterprise Attestation support to 16 Relying Party (RP) IDs on a single key to support development, testing, staging and production environments across multiple identity providers, while maintaining user privacy.
Yubico also said the firmware adds Secure Payment Confirmation (SPC) support for web-based, hardware-backed payment use cases, and includes persistent PIN/user verification authentication tokens intended to reduce the frequency of PIN prompts for users. The company said it has also added credential discovery features alongside software passkeys to reduce user confusion and lower helpdesk costs during enrolment.
“The new signing capabilities of YubiKey 5.8 are a game changer for digital identity and credentials,” said Leif Johansson, executive director at SIROS Foundation.
“In the last decade, FIDO authentication has become the industry gold standard for phishing-resistant authentication. By adding signatures, a whole range of new applications become possible without introducing platform lock-in. At SIROS, we are working to integrate the new signing capabilities into a seamless framework for secure phishing-resistant digital identity credentials,” continued Johansson.
Yubico said YubiKey 5.8 is shipping across its major product lineups from today and includes the capabilities of YubiKey 5.7.4 while expanding passkey use cases for enterprises.
The company said the YubiKey FIPS Series will remain on FIPS 140-3 validated firmware 5.7.4 “to maintain regulatory alignment”, and that the YubiKey CCN Series will also stay on 5.7.4 while it undergoes re-certification.
