This HW (including its random generator) had FIPS certification to be used in critical applications such as government. Oddly enough, the bug was added during the cert. process. Also, why Yubico has two kinds of products - one for regulars and one for governments - is beyond me.https://twitter.com/marcan42/status/1140192727268593664 …
-
This is a good example of why it *is* a good idea to have two kinds of products. To insulate yourself from any idiocy introduced during the certification process. Any real bugs found during certification would be fixed in both versions anyway, so it's a win-win to buy non-FIPS.
Also remember that the Infineon ROCA screwup (which affected all Yubikeys) also flew right past FIPS certification.