Table of Contents
What are Security Keys?
Our two-factor authentication platform supports security keys, offering secure login approvals resistant to phishing attacks combined with the one-tap convenience you're already used to with Duo Push.
A security key plugs into your USB port and when tapped or when the button is pressed it sends a signed response back to Duo to validate your login.
Duo uses the following authentication standards to interact with your security keys:
- U2F (Universal 2nd Factor) is an open standard for two-factor authentication (2FA) designed to provide a more secure and user-friendly method for verifying identity during login. It is primarily used to enhance the security of online accounts by requiring something you know (your password) and something you have (a physical device, like a USB security key).
-
WebAuthn (Web Authentication) enables two-factor authentication (2FA) using a combination of biometric authentication (like fingerprint or facial recognition), security keys, or other cryptographic devices. It works in conjunction with the CTAP (Client to Authenticator Protocol), which is the protocol used by the authenticator (the device that holds the cryptographic keys) to communicate with the client (e.g., a web browser or application).
Security Key Requirements
In order to use a security key with Duo, make sure you have the following:
Enrolling your Security Key
You can enroll your security key during the initial self-enrollment process or, if you have already enrolled in Duo using a different device (like your mobile phone), you can add your security key as an additional authentication device from the device management portal.
Initial Enrollment with a Security Key
Access the Duo enrollment page via a link emailed by your administrator, or when you log in for the first time to a Duo protected resource.
Select Security Key from the list of devices and then click Continue.
Make sure that you're not blocking pop-up windows for the enrollment site before continuing.
The security key enrollment window automatically tries to locate your connected security key for approval.
Depending on your security key model, you'll need to tap, insert, or press a button on your device to proceed.
When enrolling your security key, you'll be prompted to tap to enroll your security key (possibly more than once). You may also be asked if you want to allow Duo to access information about your security key (click Allow or Proceed as applicable).
You'll see whether the security key identification was successful or not.
Congratulations! You have enrolled your security key.
Adding a Security Key From the Duo Prompt
If you previously enrolled other devices in Duo, you can easily add your new security key as an additional authenticator as long as your administrator has enabled Duo's self-service portal.
Navigate to your Duo-protected service and log in. At the Duo Prompt you'll see an Add a new device link on the left. Click it and approve the Duo login request using your already enrolled phone or other device.
Proceed with the security key enrollment process as shown above.
You've added your security key (in this example, a securiy key from Yubico)! It is listed with your other enrolled devices.
Authenticating with a Security Key
The next time you log on using Duo, you can simply tap or insert your security key to log in. Some types of keys flash as a prompt for you to authenticate.
You do not need to explicitly select the security key from the drop-down list of available devices to use it for authentication in Chrome.
In other browsers, you do need to select your security key from the drop-down list of your authentication devices.
Once you select your security key from the list, click Use Security Key and tap your security key when prompted.
