YubiKey registration evaluation
Local demo only. This page describes an evaluator path; it does not claim Yubico approval, certification, production readiness, or verification of a device manufacturer/model.
Run the evaluator flow
- From
yubikey-mtls-demo/, runnpm installandnpm start. - Open the local demo at
https://localhost:3000. - Select Evaluator mode, register a cross-platform security key with PIN/user verification plus touch, log in, and register a test agent.
- Inspect
/evaluationand the issued certificate: the workload URI identifies the agent, while the WebAuthn credential reference remains audit metadata.
Evaluation claims
- WebAuthn requests a cross-platform authenticator.
- Evaluator mode requests and verifies user verification.
- Agent certificate issuance is bound to the credential used in the active login, not an arbitrary credential on the account.
- Attestation is intentionally
none; the app cannot prove the credential is a YubiKey or identify its model.
Known demo limits
In-memory users/sessions, demo CA and server-generated agent private keys, no persistent revocation, and no production authorization service. See the local demo README before evaluating. A hardware key improves authentication but does not itself satisfy full NIST, HIPAA, ISO 27001, OWASP, or web-security requirements.