Yubikey 4 Nano Teardown

I've owned Yubikeys for many years now, and have used them for anything from U2F and have always wondered what was (physically) going on inside them.

I, however, was too lazy to even Google until today. The only resources I could find were teardowns by HexView of Yubikey Neo and Yubikey 5 NFC.

These were quite impressive, and I was honestly surprised at just how little was in them, and how the author mentioned being able to melt the Neo in acetone. I honestly would've expected more, but I suppose that change came with Yubikey 5 series.

Even though I have now moved onto using a Yubikey 4 for my PGP and U2F needs (and Solokey Tap for NFC FIDO2 needs), I still have my first ever Yubikey 4 Nano lying around. While the key in that is still needed to decrypt some of my ancient stuff, I thought that it'd be a good candidate for tearing down as I wondered what was in such a tightly packed product.

(Quick note for the curious: I was initially going to get a Yubikey 5 NFC, but their shipment costs to Turkey increased significantly since my Yk4n and Yk4 orders. They didn't have an authorized reseller in Turkey until recently, and that reseller only sells on a platform I refuse to use. So I got a Solokey Tap and use it alongside my Yk4. Both are great and do everything they promise to do.)

The Process

As the hexview article used acetone and stated that the changes in the material were made with Yubikey 5, I suspected that I could also use acetone, especially as I have a bunch of it at hand.

I have previously used acetone to delayer stuff like smartcards:

Turkish Airlines baggage tracking card in a jar of acetone

For the most part, it just involves putting in the card you want to melt, checking it every now and then to see if any unwanted layers are coming off and getting rid of them, and pulling it out when you reach your intended layer. The process depends on a bunch of factors, but I had a lot more luck when I moved from something flat (which resulted in the need to flip the card every now and then to get it to apply to the bottom side too) to something round like a jar where the acetone acted evenly.

I had no experience with any other type of stuff, so I just dumped it in and hoped for the best:

Yubikey 4 nano at the bottom of the jar

Quite shortly after I did that, I started seeing the “white powdery substance” that hexview mentioned in their Yubikey Neo teardown.

To ensure that the process is going smoothly and to also help it along the way I ended up pulling it out every now and then to wipe the “white powdery substance” or just peel it off using tweezers when applicable:

Yubikey 4 nano covered in a white gooey substance

Yubikey 4 nano partially covered in aforementioned gooey substance, but drier now as it stayed out of acetone for a while

(Quick note: I did end up unintentionally touching and smelling this substance, and it felt, acted and smelled like super glue. This does indeed mean that I had a thin layer of it on my finger, which I quickly removed and thoroughly washed.)

Also, partially through, I saw the “milky-gray acetone solution” that hexview mentioned:

The previously clear acetone solution, now fairly gray and murky

This wasn't a great sign for me as I tend to filter and reuse the acetone, and I wasn't sure if I was going to have to dump it all afterwards. (I still don't know. The hexview page mentions that it settled. I've filtered it off shortly after removing the Yubikey in hopes that it'd help but it didn't help at all. Instead of a hacky “filter”, I later tried using a proper coffee filter, which also sadly didn't help.)

I ended up doing this around 4 or 5 times until I clearly felt with my tweezers that the middle of the layer I was on was actually just the MCU. This was hard to photograph for obvious reasons:

Internals of the Yubikey 4 nano with plastic piece flattening the board to the height of the epoxy around the MCU

I went through the edges in hopes of lifting a plastic-seeming thing that seemed to be in place, and ended up lifting it off:

Pastially Lifting off the plastic piece with my finger

I scraped off some of the “white powdery substance” that was left around the Yubikey with tweezers, and was left with the insides.

The Pictures

Before:

Bottom side of the Yubikey 4 nano

Top side of the Yubikey 4 nano

After:

Bottom side of the Yubikey 4 nano

Top side of the Yubikey 4 nano

(I also have a scan of the back here, which didn't end up being that good but it's higher quality at least.)

The Aftermath

Just to see if it works or not, I put the plastic piece back on to flatten it:

Yubikey 4 nano, with the plastic piece back on, vaguely flat

...and hackily padded it with some random adhesive label I had lying around to get it to the right height to stay in a USB port:

Shiny black layers covering the back of the Yubikey 4 nano

And would you believe it, it works:

Yubico OTP code being verified, implying that USB communications, tap detection and functionality working. This also shows the same serial number from the pre-dissolve back side.

Remarks

The Yubikey 4 Nano seems to be very clearly between Neo and 5 NFC, and this makes sense as Yubikey Neo was released in 2012 (was updated in 2014 with U2F support), and Yubikey 4 series was released in 2015, while Yubikey 5 series was released in 2018.

Yubikey 4 Nano shares the same case materials as Yubikey Neo, easily dissolveable in acetone, but has the same MCU as Yubikey 5 NFC (Infineon SLE 78CLUFX5000P01). Other than that there's not a lot I can say about the internals.

Bonus: It's not shown here, but I'd like to note that the keyring hole in hexview's Yubikey Neo teardown was improved on the full size Yubikey 4 with a golden ring (also visible in their Yubikey 5 NFC teardown). I did however have my Yubikey 4 nano's keyring hole fail on me as you can see above.