J'ai zappé de faire tourner cette info. L'implémentation OpenPGP des Yubikeys 4 (les séries précédentes ne sont pas concernées mais gèrent uniquement des clés jusqu'à 2048 bits) est du code privateur bien fermé. :(

Technically it's not running any applet, as the YK4 does not have a JavaCard environment. It's running a proprietary implementation of the OpenPGP card specification. [...]

[...]

The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to remember that open source code is no guarantee that bugs/vulnerabilities will be detected as the bug you've linked to demonstrates quite well. The bug was inherited from the upstream project which ykneo-openpgp is based on, and was NOT detected by any audit of the source code. It was interaction with the device itself which lead to it's discovery.

We're all for open source, and we try to open source as much of our code as possible when and where it makes sense, but in this case it was determined not to be so. One reason is that on the YubiKey NEO, each applet runs in its own sandbox, isolated from the rest of the system and can be audited/reasoned about on its own. This is not the case on the YubiKey 4, where each part of the system interacts with several others. Another reason that ykneo-openpgp was implemented as an open source project (aside from being able to leverage an existing project) was that it was useful for others, as it can run on a variety of devices. Again, this is not the case for the implementation running on the YubiKey 4.

Via https://twitter.com/aeris22 , si ma mémoire est bonne.