FIDO2 startup guide
How to use a Cryptnox FIDO2 SmartCard
Before you start:
Cryptnox, a Fido Alliance member, is developing and producing a range of smart cards for various applications such as FIDO2.
There is no specific FIDO2 software installation required. Compatible browsers and operating systems include built in support for FIDO2 devices (All Cryptnox software are developed for other types of cards, do not try to use them with a FIDO2 SmartCard).
For the use of a Cryptnox FIDO2 SmartCard as a security key with iPhones (as of iOS 16.3), you will need a minimum of two cards. Specific instructions for iPhone can be found on the official Apple documentation here.
You can purchase a Cryptnox FIDO2 SmartCard on Amazon or on the Cryptnox Shop.
Introduction - What is FIDO2?
The FIDO2 is a protocol natively supported by most browsers that enables users to authenticate with Fido2 compatible devices to online services, in both mobile and desktop environments.
The corresponding specifications are defined both by the World Wide Web Consortium (WebAuthn) and the FIDO Alliance (Client-to-Authenticator Protocol aka CTAP).
More info on FIDO2 on the Fido Alliance website here.
The Cryptnox FIDO2 SmartCard supports the FIDO2 protocol as well as its predecessor, U2F (FIDO Universal 2nd Factor).
It is Fido2 Level 1 Certified.
Compatibility
For mobile phones in general, the Cryptnox FIDO2 SmartCard supports NFC communication with NFC enabled iPhone and Android devices. The FIDO2 NFC communication functionality is already built in, there is no software installation required. It is compatible for usage as a security key with iPhones as of IOS 16.3 for AppleID login. A minimum of two Fido2 cards is required. Corresponding guide can be found here.
For website authentication on mobile phones (via NFC), major browsers are compatible on Android. For IOS, only Safari is compatible.
For website authentication on desktop/laptop (with a compatible card reader), the Cryptnox FIDO2 SmartCard is currently supported on Microsoft Windows with most browser such as Google Chrome, Mozilla Firefox, Microsoft Edge. On Apple MacOS, only Safari is supported on sites with a compatible implementation (compatibility is variable and must be tested on a case by case basis).
For desktop/laptop login, it is only compatible Microsoft Window with a 365 Business subscription . MacOS is not yet supported. Microsoft Windows has FIDO2 communication feature built in and does not require any software installation.
Compatible card reader for desktop/laptop must connect via USB. NFC reader must be ISO 14443 Compliant (13.56 Mhz). Contact Reader must be ISO 7816 compliant.
No software or driver installation is required. Compatibility is natively provided by the respective operating systems.
Windows Login with a Microsoft 365 Business Premium
Updated since 10th of March 2024
As listed here in the Current Partners section, Cryptnox has been registered as a Microsoft-compatible FIDO2 security key vendor. There is no need to configure Azure Active Directory anymore.
Simply go to https://myprofile.microsoft.com, Security Info -> Add sign-in method. Choose Security Key and follow the instructions. You will then be able to use a Cryptnox Fido2 card to log into your Windows Microsoft account.
General Usage (Website Authentication)
The Cryptnox FIDO2 SmartCard supports two-factor authentication (2FA) and passwordless authentication:
- With passwordless authentication, entering a password is replaced by logging in with the Cryptnox FIDO2 SmartCard.
- With two-factor authentication (2FA), the Cryptnox Fido2 SmartCard is resuired in addition to the password.
These possibilities depend of the website FIDO2 implementation. The request to authenticate with your Cryptnox Fido2 card is displayed as a pop-up notification with the “tap your security key on the reader” mention. See examples below.
With an NFC reader: simply remove and replace the Cryptnox FIDO2 SmartCard from the reader.
With Contact reader: while keeping the reader connected to the desktop/laptop via USB, remove and replace the Cryptnox FIDO2 SmartCard from the reader.
Testing
For testing, you can try registering and logging into the following “test” websites:
https://fido2-testing-tool.cryptnox.com Or https://webauthn.io
Make sure your Cryptnox FIDO2 SmartCard is connected to the desktop with an NFC or contact reader.
If the box “Authenticator Type” appears, choose “Cross Platform” (If you choose “Platform” it will use your computer operating system to store the credentials).
Click Register and follow instructions. If asked to “tap your security key on the reader” with a contact reader, extract and reinsert the card in the reader while keeping the reader connected to the desktop.
Other demo sites: Webauthn.me
Sites accepting FIDO2 and U2F
Best is to check your usual websites if they already support Fido2 Security Protocol. More and more sites support such protocol every day. If they do, they generally have specific instructions.
A non exhaustive list of sites accepting Fido2 and/or U2F can be found on Hideez site.
In Security Protocol, choose either U2F or Fido2/Webauthn.
An example: Google Account 2FA login
Go to Manage Your Google Account and enable two steps verification following the instructions on:
Enable 2-step verification for added account security
Then go to Manage Your Google Account -> Security -> 2-Step verification -> Security Keys
Then click on “Add security key” and follow the instructions on the screen.
Managing your Crypntox Fido2 Card (Reset or Pin management)
You can manage the pin or reset your Cryptnox Fido2 Card with a Windows Desktop/laptop connected to a card reader. Go to Settings -> Accounts -> Sign In Options -> Security Key -> Manage
Follow instructions and choose to manage pin or reset card.
Resetting the card will return it to factory setting and delete all credentials.
AAGUID
In some rare cases, you are required to provide the AAGUID of the Cryptnox FIDO2 SmartCard:
9c835346–796b-4c27–8898-d6032f515cc5
