Forum Discussion

JeremySRITS's avatar
JeremySRITS
Brass Contributor
May 12, 2021

Why is a PIN required for using a hardware key for MFA?

I am trying to pilot using FIDO2 hardware keys for MFA with Office 365. I see the option to add a hardware key in my Office 365 account security options. After inserting my hardware key, I get a mess...
Joe Stocker's avatar
Joe Stocker
Bronze Contributor
May 30, 2021
Microsoft has chosen to require a PIN for their implementation of FIDO2 because if someone loses the key, they don't want it to be used as single factor (something you have) and they instead want it to be multi-factor (something you know, PIN + something you have).
In your case it sounds like there was a PIN already set on that key if it is asking you for a PIN. Normally, the first time you enroll a key it will ask you to create a new PIN. So you'll need to reset that PIN. You can download a utility from the Yubico website to wipe the key so that you can establish a new PIN. https://support.yubico.com/hc/en-us/articles/360015654100-YubiKey-PIN-and-PUK-User-Management
  • JeremySRITS's avatar
    JeremySRITS
    Brass Contributor
    Jun 01, 2021

    Joe Stocker Thank you for your reply. That's good to know, and that does answer my question.

     

    That's unfortunate as my ideal configuration would be multi-factor with just password (something I know) and a hardware key (something I have) (so no third factor - no PIN), which is more consistent with the way most of the other services I use have implemented FIDO keys.

     

    Thanks again for your help.

    • bertilak's avatar
      bertilak
      Copper Contributor
      Sep 15, 2022

      JeremySRITS 

      I too feel the PIN is not necessary for 2FA as the password is the first factor and the presence of the key is the second factor. 

       

      It would be nice if things could be configured this way. Perhaps I am missing something -- if so, can someone enlighten me?

       

      I have a YubiKey 5 nano and a YubiKey 5C NFC.

      • Eric W's avatar
        Eric W
        Copper Contributor
        Mar 31, 2024

        bertilak 

        You shouldn't be asked for a password if you are setting up a security key for Microsoft. Pins should replace the password, and a Pin is different than a password it's only stored on the device vs a password stored on a server and hashed and attacked all the time. Think of a debit card, When was the last time you changed that pin? 

        You basically, have something you know (pin to unlock the key) something you have the key which has the private key to perform the authentication using cryptography instead of a hash match. 

Resources