The YubiKey is a device that makes two-factor authentication as simple as possible. Deploy the Yubikey mini driver to your machines that need local (OR RDP) login via key; Follow through page 13-14 of the document to duplicate and modify the default Windows CA template for Smartcard Logon; For test optional - configure auto-enrolment for user certificates in group policy. Click Edit on Network Settings. Once you've done that, you can put it into a machine with the Minidriver and provision certificates to it. Enter the PIN for the Smart Card and then click OK. 9am - 5pm PST, Monday - Friday. Having this driver installed the behaviour changes to the following. 0 interface as well as an NFC. Smart card functionality is one of the five authentication protocols supported. 2130) GnuPG: 2. Yubikey personalization tools and neo manager can detect and read the Yubikey but GPG cannot. Yubico Secure Channel Technical DescriptionThe YubiKey Smart Card Minidriver is not supported on Windows Server Core, either for remote or local login, as the underlying USBCCID filter driver is not present which is required. Hence, if you know that your application will be running alongside Microsoft Windows machines using the YubiKey Minidriver, you should strongly consider adding support for setting YubiKeys to PIN-protected mode. See moreSmart card drivers and tools. Microsoft and YubiKeys. Administrative Template (ADMX) for YubiKey Smart Card Minidriver Introduction. Install Yubikey Drivers. ubuntu. After importing new certs remember to useThe YubiKey 4 series can hold up to 32 OATH credentials and supports both OATH-TOTP (time based) and OATH-HOTP (counter based). Due to the open source software status of the libykpiv library, there might be other users of this library. Cheers. 1. Bugfix release: Fix broken naming for "YubiKey 4", and a small OATH issue with touch Steam credentials. If you have a YubiKey, right-click on the YubiKey device, and select Remove device. Click on Scan account QR-code, then scan the QR code from the internet page. Under the Client Certificate section, configure the following settings: a. Validating Yubikey OTPs using the AES key directly, typically only for server integration or disconnected use. one must re-enter PIN every time this private key is used). Yubikey 5 Smart Card PIV RDP Issue. The YubiKey Minidriver can be set as the default driver by following these steps: Connect your YubiKey to your computer. Home » Setup. You can also get more information from Yubico’s website. At YubiKey there’s nay tradeoff between great security and usability. The YubiKey 5 NFC has six distinct applications, which are all independent of each other and can be used simultaneously. The credential management tool replaces the default values by automatically setting a random value for the management key and PUK and allows the end user to define the PIN. - We use this Yubikey to sign Windows binaries. Windows – Double-click the Yubico-desktop-<version>. To do this: Step 1: Open up the group policy editor. In this command, you need to fill in the management key (replace "MGM-KEY". Click View devices and printers under the Hardware and Sound category. msc and press Enter . Today, PIV smart card support also is available on the YubiKey 4. When deploying the Minidriver to remote servers where the YubiKey cannot be physically inserted, a legacy node must be created to load the minidriver. Deploying multi-protocol YubiKeys is a fast, simple, and inexpensive process, thanks to its compatibility with. And reload your device. Use the YubiKey Manager to configure FIDO2, OTP and PIV functionality on your YubiKey on Windows, macOS, and Linux operating systems. Interface. bat: gpg-agent. If you have that minidriver installed you can have the user change the PIN from the Windows change password screen instead of issuing a determined PIN. Then, start the Plug and Play service on. Verify that the Card value near the beginning of the output shows YubiKey Smart Card or similar. 1. It is not compatible with Windows on Arm (ARM32, ARM64). Deploying the YubiKey Minidriver to Workstations and Servers contains detailed information about a variety of methods for deploying the YubiKey Minidriver. exe -t ecdsa-sk -C "username-$ ( (Get-Date). A scenario in which this would happen is if a YubiKey is enrolled, the certificate is exported from the YubiKey (the private key portion of the certificate is stored within the secure element of the YubiKey and is non-exportable), and then imported onto another YubiKey. Instead, the minidriver scans the PIV slots and converts any present keys to "key containers", which is how Windows deals with private keys and. To do so, install the minidriver with the INSTALL_LEGACY_NODE=1 option set. Maybe we need to impoert the certificate to smart card according to "The requested key container does not. YubiKey Manager is a cross-platform tool; it runs on Windows, macOS, and Linux. How the YubiKey works. - We have a Yubikey with code signing certificate inside. The YubiKey is compatible with the NIST PIV Specifications (SP 800-73-4). yubikey-minidriver-tool is a C library typically used in Security, Authentication applications. Click Browse, select the user you want to enroll, and then click OK. Select and copy (CTRL + C) the Thumbprint. 0. More consistently mask PIN/password input in prompts. Use a Windows 7 or 10 physical workstation to download the YubiKey Smart Card Mini Driver from the below location: The steps to import the certificate depend on whether you have the YubiKey Smart Card Minidriver installed. generic. When a smart card is inserted into the reader and the Base CSP/KSP calls CardAcquireContext, the class minidriver performs the following discovery process to mark the associated card as either PIV- or GIDS-compliant: A SELECT command is issued to locate the PIV AID. Click View devices and printers under the Hardware and Sound category. If you're looking for a usage guide, refer to this article. It does this by storing the PIV management key in a PIN protected object and using the PIN to unlock the smart card. 0 and Later; Secure Channel Specifics. 3. I had to disable one of my monitors to get the yubikey manager GUI to open. In many cases, it is not necessary to configure your. The mobile-friendly form factors and interfaces of the YubiKey will help organizations leverage their existing investment in PKI infrastructure to make mobile authentication as secure and convenient as it is on desktop operating systems. Setting up Windows Server for YubiKey PIV Authentication. 2 (i do not have this issue with 1. For the purposes of the documentation, the Yubikey 4 smart card is used and its software is open source, and available for free download from their website. Occasionally, the yubikey (though present and listed in the OS) somehow becomes inaccessible to both Windows Putty CAC Agent and Windows GPG4Win tools. Open Control Panel. YubiKey 5C NFC. If you know what the management key was changed to, you can use it to change it back to the default. 10am - 4pm CET, Monday - Friday. The driver itself is harmless it can be left as is but the "Yubikey Smart Card Minidriver" in "Programs and Features" needs to be uninstalled before Windows can interact with certs there. tar. 1. Supported Algorithms: RSA 1024; RSA 2048; USB. The YubiKey Nano FIPS (4 Series) is a FIPS 140-2 certified (Overall Level 2, Physical Security Level 3) device based on the YubiKey 4 Nano. YubiKey Smart Card Minidriver The YubiKey Smart Card Minidriver extends the PIV / Smart Card application for YubiKey on Windows. 0 or later, then the attestation statement also contains the YubiKey's serial number. PCSCExceptions. MiniDriver Installation Procedure: Download YubiKey Minidriver available at Yubico. YubiKey は YubiKey minidriver に. yubikey-client-API_x64-4. Tested on a YK5. It also supports multiple accounts so your admins can use the same method to access privileged accounts as well as their normal user accounts really easily. Version history and release notes 2. This is an optional feature to increase security, ensuring that any authentication operation must be carried out in person. YubiKeyの機能. Hopefully someone finds this. While PIV-Tool allows for the CLI to be used as part of a scripted process, the lack of support beyond the PIV functions. I successfully setup Yubikey PIV authentication on AD. Yubico Login for Windows is only compatible with machines built on the x86 architecture. When prompted, press Enter to confirm adding the PPA. This article describes the issue when upon trying to log into an Azure domain joined ARM Windows 11 virtual machine with a YubiKey token, you might not get a FIDO2 token prompt. ChrisHammond. VMware Horizon customers can leverage the YubiKey for easy to use and reliable hardware-backed protection for smart card authentication. msi (2016-04-20) yubikey-configuration-API_x64-4. 4. Note: The YubiKey 5 FIPS Series with initial firmware release version 5. The YubiKey 5C Nano uses a USB 2. At this point, a non-shared YubiKey or Security Key should be available for passthrough. If you have a YubiKey, right-click on the YubiKey device, and select Remove device. When deploying the Minidriver to remote servers where the YubiKey cannot be physically inserted, a legacy node must be created to load the minidriver. Note: Yubico Login for Windows perceives a reconfigured YubiKey as a new key. If you installed the "minidriver" and there has been an Windows OS upgrade since it was installed, you may need to uninstall it, download the latest, and then re-install the minidriver:. Thnak you for the quick reply, will spend more time with the piv tool - any current plans to provide a miniport driver able to write. The YubiKey 5C NFC FIPS is FIPS 140-2 certified (Overall Level 1 and Level 2 , Physical Security Level 3) and based on the YubiKey 5C NFC. It also supports multiple accounts so your admins can use the same method to access privileged accounts as well as their normal user accounts really easily. YubiKey Manager (ykman) Yubico Authenticator; YubiKey Smart Card Minidriver; Troubleshooting; NFC ID Calculation Technical Description. ykman piv generate-key 9a --algorithm ECCP256 /tmp/9a. This is the only way to ensure the YubiKey smart card minidriver is involved in the import and can properly maintain the container map file on the YubiKey. Discover the simplest method to secure logins today. This is useful for deployments where the YubiKeys need to be provisioned from a central location, or replacement YubiKeys need to be generated for users who have locked their PIN. 1. 1 Encrypting. In "YubiKey Manager" go to PIV -> certificates -> import the new certificate. ssh-keygen. kevinds. The stages to import the certificate are based on whether you already have installed the YubiKey smart card mini driver. OV and EV code signing certificates should not be installed manually on your computer, which may cause configuration issues. 0 and the YubiKey Smart Card Minidriver to 4. 210-x86. Resolution 1: Reset your YubiKey and follow the directions in the YubiKey. pub. For information about the specification for smart card minidrivers, see Smart Card Minidriver Specification. You'll have to use our yubico-piv-tool, piv-tool from OpenSC or a commercial alternative to do card administration. The YubiKey 5 Nano uses a USB 2. msi file by using command prompt, running: msiexec /i YubiKey-Minidriver-4. If the YubiKey is version 5. The YubiKey firmware 5. 1 yubico-piv-tool-2. This Poll aims to gauge the response of the users as to whether Yubico should proceed with the Tool's certification, instead of suggesting to users that they decrease the security posture of their. I reread the URL provided. Compare the models of our most popular Series, side-by-side. 0. Windows Smart Card Specification Version 7. dmg. Releases. I have an existing CA, I have published enrollment template. Click Next -> select Browse… -> save the file as bitlocker-certificate. 0. Deploying the YubiKey Minidriver to Workstations and Servers. YubiKey Manager; YubiKey Smart Card Minidriver; Yubico Authenticator: Windows 10. The YubiKey C FIPS (4 Series) is a FIPS 140-2 certified (Overall Level 2, Physical Security Level 3) device based on the YubiKey 4C. I have added a FIDO2 authentication method on portal. If You Know the Management Key. I was plugging the YubiKey the wrong way for this whole time Don't feel bad. For each service you set up, have your spare YubiKey ready and add it right after the first one before moving to the next. Interface. Not sure if you have a YubiKey 5 Nano. I am trying to setup smartcard authentication with windows and active directory. It has five distinct sub-modules, which are all independent of each other and can be used simultaneously. If you try to sign with the Yubikey 5 connected using signtool, you'll get the error: SignTool Error: No certificates were found that met all the given criteria. SafeNet Minidriver manages Thales extensive SafeNet portfolio of certificate-based authenticators, including eTokens, SafeNet IDPrime smart cards, SafeNet IDPrime Virtual and combined PKI/FIDO devices. Note: This article lists the technical specifications of the YubiKey 5 NFC FIPS. 1. シンプルなタッチ、もしくは PIN の組み合わせでコンピューター、ネットワーク、オンラインサービスへのアクセスを保護します。. For convenience, I name my keys containing the YubiKey number and creation date. With the YubiKey Minidriver MSI. Each device has a unique code built on to it, which is used to generate codes that help confirm your identity. The Yubico PIV-Tool was designed to interact with and manage the PIV functions alone. - Yubikey Minidriver installed on local machine & virtual machine - "regular" logon on physical machine and RDP between 2 physical machines works with Yubikey To me it seems like the User-ID/some info about the User isn't being transfered to the remote-desktop-session. The only solution that worked for us was overriding the properties with command line flags when we launch our software. x and Earlier; NFC ID Calculation for YubiKey v5. 2 does not support OpenPGP. YubiKey Smart Card Mini Driver (Windows), CAB download available from:. Click Finish to complete the installation. Click -> Run. On the login screen of computers that have the YubiKey Smart Card Minidriver installed, the user enters the PUK code that allows a new PIN code to be set. ) Yubikey: Yubico Yubikey 5 NFC (Firmware version: 5. 0. If you're looking for deployment considerations, refer to this article. Create a text file with the following contents to use as a certificate request. Linux users check lsusb -v in Terminal. Works on all YubiKeys except for the Security Key Series. We’ve also enhanced the YubiKey PIV Manager app running on Sierra with a simple self-provisioning wizard that allows non. I did notice that also the Microsoft USbccid smartcard read was added to the device manager when the Yubikey was connected. Using the Yubikey Remotely. AnyConnect does not work if more than one YubiKey is connected (tested with three). 210. Smart Card Minidrivers. Step 2: Select the Scan option to scan the QR code, getting displayed on the screen. See Admin access for details on what these unlock. The Yubikey Minidriver is not installed correctly on remote agent. If you have a Security Key, right-click on the Security Key by Yubico device and select Remove device. 16. Yubikey as SmartCard. For example something like: ykman piv generate-key --touch-policy always 9a pubkey. This tool also serves as example code for using the Windows Smart Card Key Storage Provider to create self-signed certificate via the YubiKey Minidriver. Select Enabled from the Require Touch drop-down list, if you want the users to touch their YubiKeys. Execute following commands, provide new PIN and PUK when prompted: "C:Program FilesYubicoYubiKey Managerykman. 0 and NFC interfaces. YubiKey Smart Card Minidriver (Windows) Download. As for your second question it could be any number of reasons. c. To resolve your issue, follow the instructions below:Also make sure your RDP Client is set to share Smart Cards. YubiKey device Yubico’s authentication device for connection to the USB port USB Universal Serial Bus HID Human Interface Device. 1. Open the configuration file with a text editor. com Unfortunatelly when I try to login to Windows with Yubikey I am getting a message "No Valid Certificates Were Found on This Smart Card". Inspecting the key in Yubikey manager, I saw that the PUK was locked. If you're looking for a usage guide, refer to this article. This is an optional feature to increase security, ensuring that any authentication operation must be carried out in person. yubikeyminidriver. 210-x64. azure. yubikey_manager-5. If your test Windows system is running on a Virtual Workstation , please ensure YubiKey is connected using pass through mode instead of shared device mode. Using your YubiKey to Secure Your Online Accounts. If you're looking for deployment considerations, refer to this article. msi and click Next. First, ensure that you have the YubiKey Smart Card Minidriver installed on the remote destination. I successfully enrolled a Yubikey for a regular user and the user was able to use the Yubikey to log in. I managed to generate gpg keys on the device and sign Git commits all in PowerShell. Each YubiKey must be registered individually. If you don't have an on-premise. The certificate chain is not trusted. This will reset the management key to the default and then the minidriver will be able to authenticate to the YubiKey. Locate and select the smart card template you created for enroll on behalf of, and then click Next. This chapter covers the basic configuration for setting up a new Certification Authority (CA) to a Windows Server (2016 and above). In addition, you can use the extended settings to specify other features, such as to. And x64 emulation on Windows 11 does not work for device. txt. I configured a YubiKey on Windows using the YubiKey minidriver with the - my "orion" certificate - went into slot 9a PIV Auth - A MacOS keychain cert per their docs - when into slot 9d Key Management - Another auth certificate for "orion-admin" - went into slot 82 I'm able to authenticate on Windows as either orion or orion-admin, but onDownload ykman installers from: YubiKey Manager Releases. The previous 2 certificates are still there. A notification should appear: Re-launch Veracrypt, select your encrypted drive, click , select Add/Remove keyfiles To/From Volume, and then fill in your drive credentials again. Download the YubiKey Smart Card Minidriver for Windows, macOS, Linux and other platforms to use the native Windows interface for certificate enrollment, managing the YubiKey smart card PIN, and smart card authentication. Are you saying that others have actually got it working in Core? Reply. com , and successfully added a Yubikey to one account on myprofile. This tool also serves as example code for using the Windows Smart Card Key Storage. PIV, or FIPS 201, is a US government standard. The YubiKey Minidriver will block the PUK if it is set to the factory default value. yubico-piv-tool. This tool also serves as example code for using the Windows Smart Card Key Storage Provider to create self-signed certificate via the YubiKey Minidriver. 1. The command line install is: msiexec /i YubiKey-Minidriver-4. PIV smart card compatible, smart card minidriver available on Windows YubiKey 5 Nano - Overview, Benefits, Features The YubiKey 5 Nano is a hardware based authentication solution that provides superior defense against phishing, eliminates account takeovers, enables compliance and offers expanded choices for strong authentication. The way I imported this RSA1024 certificate on both YubiKey and PivApplet, is the same command with Yubi-PIV-tool. I will try RSA2048 anyway. Now that you have to enter a Microsoft account when installing, does the installer recognise a Yubikey? I know this is a very specific question, but I hope someone has an answer. What this means is that when using a PIV key in a YubiKey, there was a default policy only and no way to generate or import a key to use a different policy. Once the PUK is blocked, it cannot be used unless the PIV applet is reset. Accept the terms in License Agreement and click Next. 4. That's it. Supported Algorithms: RSA 1024; RSA 2048; USB. I think you need to install the mini driver on the server with a specific switch. Each of these slots is capable of holding an X. The YubiKey 5C Nano FIPS is FIPS 140-2 certified (Overall Level 1 and Level 2 , Physical Security Level 3) and based on the YubiKey 5C Nano. Open Terminal. For more information on why this happens, please see The YubiKey as a Keyboard. YubiKeys implement the PIV specification for managing smart card certificates. Click Next -> check Password box -> enter a password for the certificate. ; As always, if you have any questions about the new key size requirements or any other issue relating to SSL. In the User name or Alias field, verify you have the correct user, and then click Enroll. Click New and add the absolute path to the Yubico PIV Toolin directory. . Hide all Microsoft services: Check the box that says " Hide. Date: 22 September 2017 Size: 1 MB INF file: ykmd. See the User's manual entry on PIN-only. 210-x64. RDP server is Server 2016 and client is Win10 20H2. I installed the yubikey minidriver and followed this tutorial. Run the HID Global Crescendo 2300 Minidriver 1. It won't help here. While the minidriver always asks for PIN, even if not required by YubiKey, slot 9e can still be used through PKCS11 without a PIN, so do not use it for stuff you want to keep secure. Download the OpenSC minidriver and install before installing GPG4Win. 2. Smart card minidrivers contain the features specified for a version. generic. 06. The YubiKey is a hardware-based authentication solution that provides superior defense against phishing, eliminates account takeovers, addresses compliance, and enables strong two-factor, multi-factor, and passwordless authentication. It should say scfilter, I have confirmed the scfilter driver is started on the remote machine when the yubikey is inserted so there is some detection. Configure your YubiKey for Smart Card applications. Technically these four slots are very similar, but they are used for different purposes. Launch ykman CLI, ( 64-bit)The card minidriver should be written as a generalized interface layer. Does… OK for PIV to work via Remote Desktop sessions, you need to install the mini driver with an additional setting. Unplug your Yubikey, wait 5 seconds, and plug back in. Built on the C ykpiv library, the PIV-Tool provides a CLI to access all of the functionality supported on the PIV function of the YubiKey. sha256. Do of course replace the version number by the actual version you downloaded/plan to install. If you're looking for deployment considerations, refer to this article. Enabling and disabling primary authentication methods in ADFS 2019. If a YubiKey is connected to a computer when installing the YubiKey Minidriver, Windows may continue to use the native generic smart card minidriver. We would like to show you a description here but the site won’t allow us. The YubiKey is hardware authentication reimagined. Issues addressed: Use the YubiKey Manager to configure FIDO2, OTP and PIV functionality on your YubiKey on Windows, macOS, and Linux operating systems. The authenticating entity calculates the response by encrypting the challenge by using Triple DES (3DES) that operates operating in CBC mode with a 168-bit key (and ignoring the. To do so, install the minidriver with the INSTALL_LEGACY_NODE=1 option set. 1. Works with YubiKey. Select the General tab, and make the following changes as needed:YubiKey. Load that up and set the registry key for wahtever touch policy you want to use. If You Know the Management Key. 3. 5. Contact support. The YubiKey 5C NFC FIPS has five distinct applications, which are all independent of each other and can be used simultaneously. application provides a PIV compatible smart card. Works on all YubiKeys except for the Security Key Series. 2. For more information, see VMware's KB article on this. e. Posted: Thu Oct 19, 2017 6:49 pm. The Yubico minidriver will configure a YubiKey to PIN-protected mode. It has five distinct sub-modules, which are all independent of each other and can be used simultaneously. The Yubikey 5 says it supports 12 slots. Updated the Registry with the Class GUID of the Yubikey (Series 5 NFC) - [HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTTerminal ServicesClientUsbSelectDeviceByInterfaces] Remote Windows Server. generic. ubuntu. Read the YubiKey 5 FIPS Series product brief >. Orders may be delayed during promotional periods. The YubiKey relies on protocols that are standardized, and any software that uses these protocols will work. Maybe we need to impoert the certificate to smart card according to "The requested key container does not. 1. On Windows, the smart card functionality can be enhanced with the YubiKey Smart Card Minidriver. It should now see it as YubiKey Smart Card Minidriver. Version: 3. Navigation to Certificates - Current User -> Personal -> Certificates. VMware Horizon supports PIV-compatible smart card authentication. The card identifier is a unique identifier for a card. com can be used with no additional installation beyond installing the YubiKey Smart Card Minidriver and connecting the token to your computer. inf Download driver Windows 11, 10, 8. Click Next -> select Yes, export the private key -> click Next again. With the release of a new whitepaper, FIDO Alliance Guidance for U. The YubiKey 5 NFC FIPS is FIPS 140-2 certified (Overall Level 1 and Level 2, Physical Security Level 3) and based on the YubiKey 5 NFC. YubiKey Manager is a cross-platform tool; it runs on Windows, macOS, and Linux. If you're looking for a usage guide, refer to this article. If you let Windows have its way, you may end up getting the a message stating The smart card cannot perform the requested operation or the operation requires. 4. 51. Right-click on Bitlocker certificate and select All Tasks -> Export. As an example, Google's instructions for using YubiKeys with Android can be found here. Run certutil -scinfo. To do so, you must import the certificate authority root certificate into all the device’s keystore. 1. To do so, you must import the certificate authority root certificate into all the device’s keystore. Select YubiKey Minidriver - CAB download. The Minidriver is. All NFC interfaces are turned on in the YubiKey Manager. Note: Some software such as GPG can lock the CCID USB interface, preventing another software from accessing applications that use that mode. To install Minidriver, I found that weirdly, I had to first install the MSI, and then connect the YubiKey and open “Add Hardware Wizard”, click till you can select device type “Smart card” and select the YubiKey, and finally choose the Minidriver from the available driver list. You should now see “Other supported RemoteFX USB devices. Note: If this prompt doesn't appear, see the Troubleshooting and Additional Topics section below. 172-x64. –Install Yubikey minidriver • Different process for physical and virtual servers –Enable server for SmartCard Authentication –Group Policies • Username HintOS: Windows 10 Pro 21H2 (OS Build 19044. To fix this, install the . Note: Some software such as GPG can lock the CCID USB interface, preventing another software from accessing applications that use that mode. msi (2016-04-20) yubikey-client-API_x86-4. Default policy. Locate the VM's . On Windows 10, setting the system path is done by following these steps: Open the Control Panel and select System and Security → System → Advanced System Settings. 21. Answer: Due to the changes stated below, the YubiKey is now a container-based smart card in Windows. Hence, if you know that your application will be running alongside Microsoft Windows machines using the YubiKey Minidriver, you should strongly consider adding support for setting YubiKeys to PIN-protected mode. Interface. AES Advanced Encryption Standard, FIPS-197Moreover, their PIV Minidriver has already passed similar certifications, which shows that Yubico can do it for the LSA Authentication Package, too. Type " msconfig " and press Enter. generic. If you have a Security Key, right-click on the Security Key by Yubico device and select Remove device. 1. I think you need to install the mini driver on the server with a specific switch. Posted: Thu Oct 19, 2017 9:16 pm. We would like to show you a description here but the site won’t allow us. YubiKey 5 FIPS Series devices should be deployed using a credential management tool like Microsoft ADCS with YubiKey minidriver or a third party tool. If you're looking for deployment considerations, refer to this article. 1-win64. Hence, it is possible to verify that a private key operation was performed (or will be performed) by the YubiKey and only the YubiKey. Support. If the command succeeds, Windows considers the card to be a PIV. Ready to get started? Identify your YubiKey. I just got a new computer and been fighting this problem for 6 hours now.