Hardware keys, with FIDO2 security protocol support, provide a very strong means of protection against unauthorised access as they require the physical presence of the user during login. They are simple to use – all you have to do is connect them to your device and confirm access by touch. They significantly increase the security of CAS user accounts.

Please contact your local IT support to find out about the availability of hardware keys.

Use of hardware keys is one of the two-factor authentication methods. It is highly recommended to use it as secondary method in addition to the CU Key mobile app.

The activation procedure for a hardware key depends on the brand and model of the device itself. Please read the instructions for yours thoroughly as it may require a specific activation procedure before use.

Activation procedure

1. Visit website ldap.cuni.cz/mfa and log in to CAS.

   Select "Security key" from the available options.

   
   

   

   
   

2. A field for device registration will appear. Click on "Register" and continue.

   
   

   

   
   

3. You can choose a name for your device or continue with the suggested pre-set name.

   
   

   

   
   

4. The instructions may vary depending on operation system of your PC/laptop. The following instructions apply for Microsoft Windows.

   
   

   Select “Security Key”. If you do not see it as the first option, click on “More options”.

   
   

   

   
   

5. You will be asked to connect your device and set a PIN code for it.

   
   

   

   
   

   

   
   

   

   
   

   

   
   

   

   
   

6. As soon as your device is successfully registered the system will ask you for verification via the hardware key.

   
   

   

   
   

7. If the registration is successful, you will see confirmation of the registration of your device.

   
   

   

   
   

8. Now visit a website that requires CAS login and two-factor authentication, e.g. servicedesk.cuni.cz and log in.

   
   

   

   
   

9. Click on "Other verification methods" and select "Security key".

   
   

   

   
   

   

There are several types of security keys that are compatible with CAS two-factor authentication, e.g. Windows Hello. Use of other types of security keys is based on specific workplace requirements. If you are interested in using these, please contact your local IT support.

It is possible to register only one device of this type per account.