Issuing a 5C Yubikey (Only used in special circumstances, over the standard Yubikey)

Before you Begin

In order to program the 5C NFC style Yubikeys, you will need to install the “YubiKey Manager” app and run it as Admin.  You can get it through Software Center or Apple’s Self-Service. 

 

Using 5C versus older Yubikey versions

The 5C Yubikey line is to be used in special circumstances where the older Yubikey is not authenticating properly

An employee needing to use a Yubikey with Cisco Jabber with the old Yubikey, is a known issue.

 

What is a "5C" Yubikey?

A Yubikey is a hardware-based security key manufactured by Yubico designed to protect online accounts from phishing and unauthorized access.  It serves as your physical "passkey," replacing less secure two-factor authentication (2FA) methods like SMS text codes or authenticator apps. 

"5C" specifically indicates that it belongs to the YubiKey 5 Series, or 5^th generation, that supports multiple security protocols and features a USB-C connector for modern devices. 

 

Steps/Overview

There are THREE MAIN PARTS to configuring a 5C Yubi key: 

1. Program it
2. Tie it to a User
3. Document in Grouper

 

1.) PROGRAM IT

1.       Generate Your Key Data: 

a.       Download and open the “YubiKey Manager” app.   Be sure you RUN AS ADMINISTRATOR to open it. 

 

b.       Insert your YubiKey 5C NFC …  into the USB port of your computer. 

c.       Click on the APPLICATIONS tab. 

 

d.       Select OTP from the drop-down menu. 

 

e.       Under Short Touch, click the Delete button if the slot is already configured.  Then click Configure. 

 

f.         Under “Select Credential Type” accept the default of Yubico OTP, and click Next. 

 

g.        Under “Yubico OTP” click the checkbox to the right of the Public ID field where it says “Use serial”.  This auto-fills in the Public ID, which is simply the serial number. 

h.       Click the “Generate” buttons to the right of the "Private ID" and “Secret Key” fields to generate these fields. 

i.          RECORD ALL THREE VALUES.  You’ll need them in a moment. 

• Private ID and Secret Key can be copied and pasted, but Public ID (serial number) will need to be copied out manually. 

j.          Leave the “Upload” checkbox unchecked and click the Finish button. 

 

2.) TIE IT TO A USER

k.       Armed with those numbers, log into the DUO Admin Desk

l.          Click on Devices => Hardware Tokens. 

 

m.    Click on the Import Hardware Tokens button on top right

 

n.       In TOKEN TYPE drop down, select Yubikey AES (Advanced Encryption Standard) 

o.       Referencing the numbers saved from part one, let’s say these were the numbers generated by the app: 

 

Public ID           vvcccbjnccfhe 

Private ID         7d0cbfc955d2f 

Secret Key       08e94488e480062da265eaab7b162be2 

 

p.      Paste those codes (not the titles) into the CSV TOKEN DATA field with commas and no spaces, then click on the Import Hardware Tokens button. 

 

q.       That will add your Hardware Token into Duo. You will then tie this to your User.  In the Search Bar, search the PublicID/Serial Number (vvcccbjnccfhe) and select it.

 

 

r.       Click on Attach User button 

 

s.         You’ll be prompted for the user’s NUID number.  Enter it and select ATTACH button

 

t.       You will see this banner at top if it was successful

 

u.         Remove the Yubikey 5C and get it to the User per their directives in TDX ticket. See below instructions "Delivery or Pickup of Yubikeys from Requested User"

 

3.) DOCUMENT IN GROUPER

• Login to Grouper and go to the Grouper Group Management Page
• Go to Home > Root > ref > security > duo > hardware_tokens > YubiKey 5Cs Distributed

• Click the yellow ADD MEMBERS button
• Enter user by NUID and click ADD, to add them to the database

 

Delivery or Pickup of Yubikeys from Requested User

Option A.) USPS Mail

• Mailing Address needs to have your Official Department Name and the 4 digit department code at end of the zip code in order to pay for postage. No postage stamp is required when dropping off in mail room due to this.
• The mail room is located in the SW corner of Love Library South on the 1st floor.  The mail drop is right inside the door.  Look for (3) labeled bins on the wall.
• The return mailing address for UNL Huskertech is: 

UNL HuskerTech Help Center 

Love Library-South (LLS); Rm 31 

Lincoln NE  68588-0496 

 

Option B.) Pickup at Repair Center

• The alternative is to pick one up in our main office, in which case we simply drop it in an envelope, put their name on it and pin it to the board that is by the student workers.