Skip to content

docs: Corrected docs on attestation statement #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 20, 2025
Merged

docs: Corrected docs on attestation statement #236

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 10 additions & 15 deletions docs/users-manual/application-piv/slots.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,21 +64,16 @@ keys.

## Attestation Key

The attestation key (in slot `F9`) will be used to create an attestation statement (which
is an X.509 certificate) that attests a key in slot `9A`, `9C`, `9D`, or `9E` was
generated on the YubiKey.

Upon manufacture, a private key and cert pair is loaded into slot `F9`. This key is
generated by Yubico, the cert is signed by a Yubico CA and chains to a Yubico root. The
same key and cert are loaded onto many different YubiKeys. See the article on
[PIV attestation](attestation.md) for more information on this topic.

Note that if a private key was imported into one of those slots, it will not be possible
to create an attestation statement for that slot.

It is possible to have the YubiKey generate a key pair for one of the retired slots
(`82` - `95`). However, the attestation key will not generate an attestation statement for
a key in one of those slots, even if it was generated by the YubiKey.
The attestation key (in slot `F9`) is used to create an attestation statement (an X.509
certificate), which attests that a key in slot `9A`, `9C`, `9D`, `9E`, or one of the
retired slots (`82` - `95`) was *generated* on the YubiKey. If a private key was *imported*
into one of those slots, it will not be possible to create an attestation statement for
that slot.

Upon manufacture, the attestation key (a private key and certificate pair) is loaded into slot
`F9`. This key is generated by Yubico, and the cert is signed by a Yubico CA and chains
to a Yubico root. The same key and cert are loaded onto many different YubiKeys. See the
article on [PIV attestation](attestation.md) for more information on this topic.

## Generate and import asymmetric keys

Expand Down