People who wish to use a physical hardware token for 2-Step verification should pick up a Simple Hardware Token free of charge. For most users, if you don't have a smartphone or landline available, a Simple Hardware Token is sufficient.
If you purchase your own Feitian FIDO Key or YubiKey, you can take advantage of its ability to function using USB-provided power without needing an internal battery. Following the instructions below, you may self-register your key as a WebAuthn/FIDO2 security key for use with Duo.
Feitian FIDO Keys
Feitian FIDO Keys can be purchased as a personal security device for 2-step authentication. The keys are available in multiple forms and are compatible with multiple interfaces, including USB-A or USB-C, to fit all of your computers and mobile devices.
YubiKeys
YubiKeys can be purchased at yubico.com/store/ and work with most web services on most devices.
Enrolling Your Key as a WebAuthn/FIDO2 Security Key Using the Duo Device Management Portal
- You must already have enrolled at least one device—smartphone, tablet or basic cell phone
1. 
Log In to CalNet
From the CAS login screen (ex: https://bpr.calnet.berkeley.edu/account-manager/login/auth),
2. Access the Device Management Portal
-
A 2-Step prompt will appear after you enter your CalNet ID and passphrase.
- If you are automatically logged in and the 2-Step prompt is bypassed, try either clearing cache/cookies or using an incognito browser
-
At the bottom of the page, select Other Options
-
Under your list of existing devices, select Manage Devices
-
Complete a 2-Step verification.
3. Add Your Device
-
Once authenticated, you will land on the Duo Device Management Portal. Your existing devices will be listed.
-
Select Add a New Device
- Select Security Key
- Select Continue
- When prompted, insert your Key into your computer and touch it
Enrollment Completed!
Congratulations! You’ve successfully enrolled your Key. Now when you log in to campus systems, you will be prompted for a second-step verification.
Advanced Use Case -- YubiKey AES and OAUTH-HOTP
Advanced users may wish to enroll a YubiKey using AES or as an OAUTH-HOTP device. These are not required to use CalNet 2-Step Verification, but advanced users may wish to leverage features of YubiKeys for specific departmental Duo integrations. Find out more at Advanced YubiKey Setup.