DoD ECA certs can go on Yubikeys (eom)

Very nearly no one needs to know this.

The US DoD operates a public key infrastructure for its staff and contractors to secure their activities on the public internet. This means that a person or other entity can associate themselves with a key pair, get that key pair signed by the creatively-named External Certificate Authority traceable to the DoD Root CA, and use the resulting certificate and key for the usual set of cryptographic activities: signing and encrypting emails, authenticating to websites, etc.^[1] There are a variety of certificate types available, each with slightly different assurances, more or less documented in the publicly-available ECA Certificate Policy. Some of these certificates require that they and the corresponding keys be stored in a dedicated hardware token.

How do you get a key signed and a certificate generated? Large prime contractors will have their own delegated "Registration Authority" capable of signing keys and verifying the association between the meat-based personal identity and possession of the resulting certificate. Outside a dozen or so contractors with their own RA/CA, you'll have to use one of two vendors to perform these two functions. Both will try to sell you their own FIPS smartcards and USB readers, presenting their use as mandatory policy, but at the end of the day the resulting certificates are X.509 certificates usable in any token supporting the Personal Identity Verification profile.

One such token, fully within DoD policy, is a FIPS Yubikey. The locally-run Windows application provided by Widepoint which performs the key generation and transacts with the Widepoint CA for signing will provision these just fine.