September 2026 - powershellYK

What’s Changed

SSH certificate support

Adds support for attesting SSH (OpenSSH) credentials prior to CA signing—verifying that keys were generated on a YubiKey.

• New-Challenge – Generates a cryptographically secure challenge for attestation workflows.
• Confirm-YubiKeyFIDO2Attestation – Validates OpenSSH attestation objects to confirm YubiKey-backed credential creation.

Large Blob support

Adds support for FIDO2 Large Blobs, enabling storage and transport of data bound to credentials (e.g., SSH user certificates).

• Import-YubiKeyFIDO2Blob – Imports a blob to a credential (creates a large-blob credential if needed).
• Export-YubiKeyFIDO2Blob – Exports a blob from a credential.
• Get-YubiKeyFIDO2Credential – Now supports filtering by Relying Party ID (e.g. ssh:, login.microsoft.com).

💡 Not limited to certificates—can store arbitrary data.

PRF-based file encryption

Introduces file encryption using the FIDO2 PRF (hmac-secret and hmac-secret-mc ) extension(s).

• Protect-YubiKeyFIDO2File – Encrypts a file using a PRF-derived key (creates a prf-encryption credential if needed).
• Unprotect-YubiKeyFIDO2File – Decrypts a file and automatically resolves the correct credential.

🔒 Credentials are non-exportable. Loss or reset may result in permanent data loss.

PACS enhancements

Adds NFC ID output to simplify integration with Physical Access Control Systems (PACS).

• Get-YubiKey – Now includes NFC ID (in dec and hex).

Misc. improvements and fixes

• Fixed PIV PIN Reset
• Updates to documentation

Requirements

• PowerShell 7.6

Full changelog

0.2025.11.1...0.2026.9.1

What's Changed

• Updated the workflow for the release by @virot in #210
• Workflow add .net 9 and .net 10 by @virot in #211

Full Changelog: 0.2026.9.1...r0.2026.9.1