Information is light about an actual Proof of Concept here.
I have no actual knowledge, and it makes sense to assume the PIN is required to implement the EM side channel attack, as without a valid PIN the old, vulnerable Infineon library most likely does not complete all the steps.
Requiring/not requiring the PIN is a per-authentication flag that the RP can set though, as far as I know.
Since the RP challenge is not authenticated in any way, nothing seems to prevent an attacker from just preparing a "user verification not required" challenge and getting the Yubikey to sign it.
Oh, potentially important corollary: This means that this vulnerability allows breaking an “always UV” credential as well:
- Do as many UP-only challenges as required on a stolen Yubikey to extract the private key, not involving the RP (or maybe a single incomplete one, to discover the credentialID)
- Use the recovered private key in an UV challenge against the RP
I have no actual knowledge, and it makes sense to assume the PIN is required to implement the EM side channel attack, as without a valid PIN the old, vulnerable Infineon library most likely does not complete all the steps.