In comparison to a One-Time Password generator such as the Google Authenticator app, handling of a U2F security key is much easier. The cost for a Yubikey starts around 20$ which is a very good investment. MFA should always be considered where a cloud provider is offering it.

It takes you only a minute or two to enable MFA with a U2F security key like Yubikey but it provides you a significant amount of additional security to your account. The server can now use the stored public key of the registered U2F hardware key for the final authentication. The U2F hardware key now signs a so-called challenge c and sends it back to the server. For each authentication process later the service transmits back the user’s key handle and additional data like server address and session id. Within the registration process, the public key and a randomly generated key handle get transferred to the server and stored there. This key-pair depends on data like the server address, TLS-certificate, and some randomly generated session id (token). If your Yubikey gets registered for the MFA process a key-pair consisting of a private and public key gets stored on the hardware key itself. A FIDO2 compatible hardware key will most likely support FIDO1. The successor FIDO2 allows login even without an initial password. The consortium has members such as Google, yubico, Amazon, Intel, Infineon, Microsoft and many others. U2F stands for Universal 2nd Factor which is an open standard defined by the FIDO Alliance. Theory Behind Using U2F Keys As A MFA MethodĪmazon AWS supports only U2F compatible hardware keys for two-factor authentication (2FA).

Amazon 2fa yubikey