# Nitrokey 3C NFC, hardware attestation and OpenAI Daybreak compatibility **URL:** \ **Category:** FIDO2 / Nitrokey 3\ **Created:** [November 10, 2026, 9:43am UTC](https://support.nitrokey.com/t/nitrokey-3c-nfc-hardware-attestation-and-openai-daybreak-compatibility/7814 "2026-11-10T09:43:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![olpaw](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/o/7ba0ec/32.png) [@olpaw](https://support.nitrokey.com/u/olpaw)\ **Post date:** [November 10, 2026, 9:43am UTC](https://support.nitrokey.com/t/nitrokey-3c-nfc-hardware-attestation-and-openai-daybreak-compatibility/7814/1 "2026-11-10T09:43:21Z")
I am trying to use it as a hardware security key for OpenAI Daybreak. OpenAI Daybreak requires users to register a physical FIDO2 security key. However, OpenAI explicitly excludes certain FIDO2 devices, such as the TrustKey T110 and T120, despite their general WebAuthn/FIDO2 functionality. From what I understand, OpenAI may require verifiable hardware attestation and trusted authenticator metadata to establish that private keys are securely stored in dedicated hardware. While researching the Nitrokey 3C NFC, I came across several questions: 1. FIDO Alliance Metadata Service (MDS) **:** Is the Nitrokey 3C NFC currently registered in the official FIDO MDS? I couldn’t find a corresponding entry for its AAGUID (`ec99db19-cd1f-4c06-a2a9-940f17a6a30b`). Is there an update to the current certification status of the Nitrokey 3C NFC? 2. Hardware attestation: Does the Nitrokey 3C NFC provide a verifiable attestation certificate chain that services such as OpenAI can use to confirm its hardware security properties? I read that the Nitrokey 3 does not use its Secure Element for FIDO2 operations. Could this affect compatibility with services enforcing strict hardware security requirements? Thank you! ---
**Author:** ![robin-nitrokey](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/r/b19c9b/32.png) [@robin-nitrokey](https://support.nitrokey.com/u/robin-nitrokey)\ **Post date:** [November 10, 2026, 10:19am UTC](https://support.nitrokey.com/t/nitrokey-3c-nfc-hardware-attestation-and-openai-daybreak-compatibility/7814/2 "2026-11-10T10:19:14Z")
> [@olpaw](#): > > 1. FIDO Alliance Metadata Service (MDS) **:** Is the Nitrokey 3C NFC currently registered in the official FIDO MDS? I couldn’t find a corresponding entry for its AAGUID (`ec99db19-cd1f-4c06-a2a9-940f17a6a30b`). Is there an update to the current certification status of the Nitrokey 3C NFC? Currently, only the Nitrokey 3 A Mini is listed in the FIDO MDS because it is the only Nitrokey 3 variant with a FIDO Alliance certification. We consider also getting a certification for the Nitrokey 3 NFC variants, but there are no concrete plans yet. I’ll have to check if we can add it to the MDS even without a certification. > [@olpaw](#): > > 1. Hardware attestation: Does the Nitrokey 3C NFC provide a verifiable attestation certificate chain that services such as OpenAI can use to confirm its hardware security properties? I read that the Nitrokey 3 does not use its Secure Element for FIDO2 operations. Could this affect compatibility with services enforcing strict hardware security requirements? Do you have more details on this requirement? We do provide a verifiable attestation certificate chain, but I’m not sure how this relates to the hardware security properties. Maybe this also refers to the metadata from point 1. Then we would first have to clarify the MDS status. ---
**Author:** ![olpaw](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/o/7ba0ec/32.png) [@olpaw](https://support.nitrokey.com/u/olpaw)\ **Post date:** [November 10, 2026, 1:25pm UTC](https://support.nitrokey.com/t/nitrokey-3c-nfc-hardware-attestation-and-openai-daybreak-compatibility/7814/4 "2026-11-10T13:25:42Z")
Thank you for your response I looked into the FIDO Metadata Service (MDS) and noticed that FIDO certification and MDS registration are two separate things. According to the [FIDO Alliance documentation](https://fidoalliance.org/mds-portal-user-guide-for-vendor-users/), an authenticator can be listed in the MDS without being FIDO certified. From your response, I understand that the Nitrokey 3C NFC is currently neither FIDO certified nor listed in the MDS. Is that correct? Regarding my issue with OpenAI Daybreak, OpenAI Support told me: > We cannot currently confirm whether the Nitrokey 3C NFC meets Daybreak’s compatibility requirements or provide specific attestation certificate-chain requirements. They referred me to their [troubleshooting article](https://help.openai.com/en/articles/20001259-troubleshooting-openai-daybreak), which doesn’t seem to provide further technical requirements beyond mentioning the TrustKey T110 and T120 as unsupported. However, I also came across information suggesting that Daybreak requires hardware security keys to: - “store private keys in secure hardware in a way that prevents their export”; and - “be identifiable by OpenAI through trusted authenticator metadata, such as the FIDO Alliance Metadata Service.” I’m not sure whether these are officially enforced requirements, but they made me wonder about two possible compatibility issues. First, the Nitrokey 3C NFC apparently isn’t listed in the MDS. Second, while its FIDO2 private keys are non-exportable through normal interfaces, FIDO2 uses the main microcontroller rather than the SE050 Secure Element. Since OpenAI hasn’t been able to clarify the exact requirements, I’m trying to understand whether either of these factors could explain why my Nitrokey works for regular FIDO2 authentication but isn’t recognized as eligible for Daybreak. ---
**Author:** ![robin-nitrokey](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/r/b19c9b/32.png) [@robin-nitrokey](https://support.nitrokey.com/u/robin-nitrokey)\ **Post date:** [November 10, 2026, 2:44pm UTC](https://support.nitrokey.com/t/nitrokey-3c-nfc-hardware-attestation-and-openai-daybreak-compatibility/7814/5 "2026-11-10T14:44:00Z")
> [@olpaw](#): > > From your response, I understand that the Nitrokey 3C NFC is currently neither FIDO certified nor listed in the MDS. Is that correct? Yes.