Overview
A security key is a physical device that you can use for multi-factor authentication. You can use a security key with your computer, phone, or other devices. Security keys function using USB-provided power without needing an internal battery. Already enrolled your security key? See how to use it below.
Campus Departments
Campus departments and managers may purchase YubiKeys for their employees via YubiCo or Amazon. We recommend purchasing the YubiCo NFC Security Key. Be sure to purchase USB-A or USB-C as needed for your employee devices.
Employees and Affiliates
We recommend installing the Duo Mobile app on your work and personal smartphones. If you do not have a smartphone to use the Duo Mobile App, you may request a free YubiKey NFC Security Key for use with your campus-owned computer. To request a key, email calnet2-stephelp@berkeley.edu.
Students
We recommend moving to the Duo Mobile app - it’s the easiest way to do the CalNet 2-Step. If you do not have a smartphone to use the Duo Mobile App, you may request a free YubiKey NFC Security Key for use with CalNet 2-Step. To obtain a key, visit a Student Technology Services help desk in person.
Lost Keys
If you lose your campus-provided security key you will need to purchase a replacement. Any key labeled as “FIDO2 compatible” should work with CalNet 2-Step. When placing your order, make sure you get one that will fit in your computer port, either a USB-A or USB-C.
Keys we recommend:
Enrolling Your Security Key
- Log in to mycalnet.berkeley.edu using your CalNet ID and passphrase, and, if prompted, complete a 2-Step verification
- Click on Manage 2-Step Verification
- Click on Duo Device Manager
- Log in again using your CalNet ID and passphrase
- Complete a 2-Step verification
- Once authenticated, you will be directed to the Duo Device Management Portal. Your existing devices will be listed.
- To register your key, select Add a Device
- Select Security key from the Select an option screen:
- Select Continue
- When prompted, insert your key into your computer and touch it. Ignore the screen that pops up prompting you to scan a QR code. Touching the security key is what will add the key to your Duo account.
- When complete, click the Complete button.
Enrollment Completed!
Congratulations! You have successfully enrolled your security key.
Using your Security Key to 2-Step
- Log in to your CalNet account with your usual credentials
- You will then be prompted to complete a 2-Step using your security key.
- If you are not prompted to use your security key, click Other options and then select security key.
- A pop-up will appear saying "Use your security key with duosecurity.com. Insert your security key and touch it."
- Insert your security key into your device's USB port and tap the touch button
- Congratulations! You are now logged in.
- If you are using your security key with a mobile device, you may be prompted to enter a PIN
- Security keys have a default PIN of 123456
Using YubiKey as a One-Time-Password Token
YubiKeys as OTP Tokens can be used anywhere a Duo passcode is accepted; this includes all web browsers as well as non-web integrations. In order to use a YubiKey as an OTP Token, it must first be programmed. This is a complicated procedure. All modern browsers support FIDO2, so we highly encourage you to self-register your YubiKey (instructions above).
If you still want to use your YubiKey as an OTP token, email calnet-admin@berkeley.edu.
For a more in-depth discussion of YubiKeys, see Yubico OTP vs. U2F and Configuring YubiKeys for OTP use with Duo