Summary
This article provides basic recommendations for USNH approved Hardware Security Keys (FIDO2) such as YubiKey 5 or Kensington's VeriMark NFC+. This article is intended for USNH students, faculty, and staff and describes the USNH recommended multi-factor authentication (MFA) hardware security keys.
For personal use any hardware security key from Yubico or Kensington should be sufficient. Hardware keys are available from the manufacturer or through popular online vendors such as BestBuy, Staples, Walmart, etc. Faculty and Staff may also purchase through the Connection punchout in the USNH UShopNH portal . ET&S does not provide security keys for students, faculty, or staff.
If you have special requirements, federal grant requirements, or security-related questions, submit a General Cybersecurity Request explaining your needs.
Security Key Acronyms
FIDO2 = Fast Identity Online 2 - In practice, it means it's very secure and we trust it. NFC is different and the two are not mutually exclusive.
NFC = Near Field Communication - In use, you do not actually need to plug into the device, it can just be very close to it instead, also known as "tap to authenticate". FIDO2 is different and the two are not mutually exclusive.
FIPS = Federal Information Processing Standards - Higher security standard that may sometimes be required for certain government grants and other high-security systems. If you believe you need to be FIPS-compliant, please submit a General Cybersecurity Request explaining your needs.
Content
Hardware Security Keys
A hardware security key is a small USB device that is inserted into a USB port on your computer or mobile device. It stores your passkey directly on a physical key and can be used without relying on your smartphone or computer.
Pressing the top or side button on the security key generates and automatically enters a passcode on MFA prompts. Many security keys also support Near Field Communication (NFC) which is a contactless technology similar to tap-to-pay. If your smartphone supports NFC, you can sign in directly on your device by simply holding the key against your phone.
Hardware keys in this article meet Microsoft’s Modern Authentication hardware requirements.
Warning: Microsoft may require a PIN when using some models of hardware security key for M365 MFA.
Remember your hardware security key PIN or it will not work for M365 MFA.
For example, the YubiKey PIN is maintained through a desktop app provided by the YubiKey manufacturer called "YubiKey Manager". If you lose or forget your YubiKey PIN, you will have to work with the YubiKey "YubiKey Manager" application to reset your PIN, or work with the YubiKey manufacturer directly - ET&S has no access to assist with lost YubiKey PINs. This is why ET&S Strongly recommends you have a secondary method set up for MFA. See MFA: Adding Backup Multi-Factor Authentication (MFA) Methods for instructions.
YubiKeys 5 Series from Yubico (non-FIPS)
NOT for use with FIPS (federal information processing standards) systems such as Federal Grants.
Recommended for all other non-FIPS USNH systems.
Available in several form factors including USB-A, USB-C, NFC, and Lightning.
Recommended connector types are:
- YubiKey 5C NFC (USB-C)
- YubiKey 5Ci (USB-C & Lightning)
Available from Yubico directly, or through popular online vendors such as BestBuy, Staples, and Walmart. Available for faculty/staff purchase through the Connection punchout in the USNH UShopNH portal . ET&S does not provide security keys for students, faculty, or staff.
Kensington VeriMark Security Key (non-FIPS)
NOT for use with FIPS (federal information processing standards) systems such as Federal Grants.
Recommended for all other non-FIPS USNH systems.
Available from Kensington directly or for faculty/staff purchase through the Connection punchout in the USNH UShopNH portal . ET&S does not provide security keys for students, faculty, or staff.
Further Readings
MFA: Setting up YubiKey for Microsoft Authentication
MFA: Adding Backup Multi-Factor Authentication (MFA) Methods
MFA: Multi-factor Authentication and USNH Systems
Multi-factor Authentication (MFA) - Knowledge Base articles
IT Guide: USNH Equitable Access to Technology
NIST FIPS 140-2: Security Requirements for Cryptographic Modules - NIST Computer Security Resource Center
UShopNH portal
- Scroll down to the Technology section and open the Connection punchout
- Scroll down to Adapters & Accessories > link to purchase approved security keys
Yubico
Kensington VeriMark NFC+ Security Key Setup Guide
Need additional help?
If you have special requirements, federal grant requirements, or security-related questions, submit a General Cybersecurity Request explaining your needs. Visit the Technology Help Desk Support page to locate your local campus contact information or to submit an online technology support request. For password issues you must call or visit the Help Desk in person.