PIV operations over Android NFC fail with 0x6982 when touch policy is not "never"

[episource]

Device: Google Pixel 9 Pro, Android 17
Token: YubiKey 5 NFC, firmware 5.1.2
YubiKit: AndroidDemo built from main, revision eb953d4

Attempts to use a YubiKey PIV private key over Android NFC fail with status word 0x6982 (SECURITY_CONDITION_NOT_SATISFIED) when the key's touch policy is set to anything other than never.

The issue is reproducible with YubiKit's AndroidDemo application using its Sign feature. I initially encountered the same behavior while implementing direct APDU communication myself. In both cases, the operation succeeds when the touch policy is set to never.

It is unclear from the documentation how PIV user presence / touch confirmation is expected to work over NFC. Yubico's documentation appears to provide conflicting information:

• Touch is described as working similarly over USB and NFC: YubiKey transport overview
• Another document states that tapping the YubiKey against the NFC reader replaces pressing the touch sensor: YubiKey Hardware guide

When performing the PIV operation over NFC, the YubiKey returns 0x6982 immediately rather than waiting for user presence.

Is this expected behavior for PIV over NFC, a limitation of firmware 5.1.2, or an issue with the Android/NFC transport? Alternatively, is a different APDU sequence required when using a PIV key with a touch policy over NFC?

[AdamVe]

Thanks for reporting! I will look into this as soon as possible.

[episource]

I've now tested with a newer YubiKey 5C NFC running firmware v5.7.4. With this key, PIV operations requiring touch work as expected over NFC, both in my application using direct APDU communication and in YubiKit's AndroidDemo application.

The YubiKey Hardware guide appears to accurately describe the behavior: tapping the v5.7.4 YubiKey against the NFC reader satisfies the user-presence/touch requirement. No separate press of the touch sensor is required.

This suggests that the failure observed with my older YubiKey running firmware v5.1.2 may be specific to older YubiKey firmware versions, rather than to Android's NFC stack or YubiKit itself.

I couldn't find any corresponding PIV/NFC touch-policy change or fix documented in the YubiKey firmware overview.

Is there a reasonable workaround for YubiKeys with older firmware? What is the minimum firmware version that correctly supports PIV touch policies over NFC?

[AdamVe]

Thanks for testing with the 5.7.4 key. We're looking into it and I'll follow up here.

[AdamVe]

Following up on this. I've tested across the firmware versions I have on hand, both through YubiKit on Android and with a desktop contactless reader. It reproduces consistently on a 5.0.2 key, and I could not reproduce it on 5.4.2 or newer.

There is no workaround I am aware of.

[episource]

Thanks for investigating. So this is a yubico-confirmed firmware bug fixed in 5.4.2 and newer?

[AdamVe]

I reconfirmed that this behavior occurs on older firmware (5.0.2 / 5.1.2) and does not occur on 5.4.2 or 5.7.4. Given the age of these keys, I'm unable to pinpoint the exact intermediate version change or root cause.

If you need more detailed information, feel free to open a request at https://support.yubico.com/s/.

For keys where this occurs over NFC, the options are:

• Provision the PIV slot with the touch policy set to never if NFC transport is required.
• Perform PIV operations requiring touch over a USB connection.

Thanks again for bringing this up and sharing your test details!