How to Use a Security Key (YubiKey) for 2-Step
A security key is a physical device used for multi-factor authentication. These devices are durable, battery-free, and function using USB-provided power. They are an ideal alternative for users who do not have a smartphone or work in areas without cellular service.
Contents
1. How to Obtain a Security Key
Campus Departments
Departments may purchase YubiKeys for employees via Yubico or Amazon. We recommend the Yubico NFC Security Key. Ensure you purchase the correct connector type (USB-A or USB-C) for your department's devices.
Employees and Affiliates
If you do not have a smartphone to use the Duo Mobile App, you may request a free YubiKey NFC Security Key for use with your campus-owned computer. To request a key, email calnet2-stephelp@berkeley.edu.
Students
If you do not have a smartphone to use the Duo Mobile App, you may request a free YubiKey NFC Security Key. To obtain a key, visit a Student Technology Services help desk in person.
2. Lost Keys
If you lose your campus-provided security key, you must purchase a replacement. Any key labeled as “FIDO2 compatible” will work with CalNet 2-Step. Recommended models include:
3. Enrolling Your Security Key
- Log in to mycalnet.berkeley.edu using your CalNet ID and passphrase.
- Click on Manage 2-Step Verification.
- Click on Duo Device Manager and log in again if prompted.
- Once in the Duo Device Management Portal, select Add a Device.
- Select Security key from the list of options.
- Select Continue.
- When prompted, insert your key into your computer and touch the gold sensor. (Note: If a screen pops up asking to scan a QR code, ignore it and simply touch your key).
- Click Complete.
4. Using Your Security Key to 2-Step
- Log in to your CalNet account with your usual credentials.
- You will be prompted to 2-Step. If you are not automatically prompted for your key, click Other options and select Security key.
- A browser pop-up will appear: "Use your security key with duosecurity.com. Insert your security key and touch it."
- Insert the key into the USB port and tap the touch button.
- Note for Mobile Devices: If using a key with a phone or tablet, you may be prompted for a PIN. The default PIN is
123456.
5. Using YubiKey as a One-Time-Password (OTP) Token
YubiKeys can be programmed as OTP Tokens for use in non-web environments (such as certain command-line tools). This is a complicated procedure. Because all modern browsers support FIDO2, we highly encourage you to use the standard enrollment instructions above.
If you specifically require OTP programming, email calnet-admin@berkeley.edu for assistance.
Technical Resources: