NHS FIDO2 Manuel utilisateur

FIDO2 Security Tokens

User Guide

Instructions for Users on the use and management of FIDO2

security keys through the NHSmail Portal.

CONTENTS

MANAGING SECURITY KEYS

This section provides instructions on how to manage security keys

FAQ

This section provides answers to common questions and scenarios.

01 FIDO2 OVERVIEW

Introduction to FIDO2 security keys

FIDO2 Security Keys

User Guide

Step by step instructions for Users

on the use and management of

FIDO2 security keys through the

NHSmail Portal.

FIDO2 OVERVIEW

What is FIDO2

FIDO2 is an open authentication standard developed by the FIDO2 Alliance

in collaboration with the World Wide Web Consortium (W3C).

FIDO2 uses public-key cryptography to provide secure and convenient

authentication technology. For every account that uses a FIDO2 security key,

there is a public and private key that enable services to validate the identity

of users and their security key.

Prior to being able to use a FIDO2-enabled security key, users must register

their key with the NHSmail platform.

When users then authenticate, their identity can then be verified with a

simple action, such as scanning a fingerprint or touching the security key.

The NHSmail platform and the user's authenticator conduct a challenge-

response to verify that the user is in possession of the correct private key.

Each registration uses a unique key pair, and the private key never leaves

the user’s security key.

For further information, read this FIDO2 Overview article.

MANAGING SECURITY KEYS
02
Navigate to ‘Manage FIDO2 Tokens’
In order to register a new token, please login to the NHSmail Portal
using your NHSmail account details ([email protected]).
Navigate to your Profile page and select the Self-Service tab. On this 
page click on the Manage FIDO2 Tokens button.
This will take you to the FIDO2 management page where you will be 
able to register, edit and remove any FIDO2 security tokens.
Manage FIDO2 Tokens
Register a new token
On your FIDO2 token management page, click on the Register New Token button and follow the instructions on your screen. 
A window will appear asking you to confirm you want to set up your security key. Click OK and then insert your security key 
when prompted. You will then be asked to create a PIN for this security key (minimum 4 numbers). You will need to use this 
PIN during future login attempts, so it is important that you remember the PIN.
Once you have registered a PIN you will be asked to touch the security key to confirm your presence and then provide a valid 
nickname for the security key. This nickname is used to identify the correct security key during the login process so be sure to 
give it an appropriate and recognisable name.
Edit a token nickname
On your FIDO2 token management page, you will see a 
list of registered security tokens. Click on the Edit button 
next to the specific security key you wish to change.
Provide a new valid nickname for the security key and 
click Save Changes.
Note that this nickname is used to identify the correct 
security key during the login process so be sure to give it 
an appropriate and recognisable name.
Remove a token
On your FIDO2 token management page, you will see a list of 
registered security tokens. Click on the Remove button next 
to the security key you wish to remove. A new window will 
pop up to confirm you wish to remove this security key.
Once you have removed the security key, you will no longer 
be able to login using that specific security key. This will be 
effective immediately. Any existing sessions will last until 
your next login attempt.
For further guidance, there is a ‘How-To-Video’ available to watch with step-by-step instructions on registering and managing 
your FIDO2 token. If you have any issues or queries, please contact a Local Administrator at your organisation.

FAQ
03
My token is not working
If you are not able to login with your FIDO2 security token, please try the 
following:
•Check if you have internet connectivity
•Check if it works to login with your token from a different browser
•If you have a backup option for MFA set up on your account, please login to 
the NHSmail Portal and follow the steps to remove and re-register the 
FIDO2 security token
If none of the above resolves the issue, then it may be a problem with the 
hardware. Please contact a Local Administrator who should be able to help 
investigate this further.
I have forgotten my PIN
If you have forgotten your FIDO2 security token PIN, there are two options 
available to reset your PIN. If you have an alternative option for MFA set up on 
your account (e.g. Microsoft Authenticator App or second FIDO2 security token), 
you can reset your PIN with the following steps:
•Reset your security key to factory settings on a Windows 10 device
•Remove your registered security token in the NHSmail Portal
•Re-register your security token with a new PIN in the NHSmail Portal
Alternatively, contact a Local Administrator who should be able to help you reset 
your PIN. They will need access to your token to do this.
My token has been misplaced / stolen
If your token has been stolen, misplaced, or otherwise lost, please make sure to 
remove the security token from your list of registered tokens in the NHSmail 
Portal. This is critical as an attacker may attempt to use the token to gain 
unwarranted access to systems.
It is also advised that you follow local procedures to report this as appropriate. If 
you have any queries, please contact a Local Administrator at your organisation.
I want to start using FIDO2
If you want to start using FIDO2, please contact a Local Administrator who 
should be able to advise you on the process for getting a security token at your 
organisation. 
Please note that as of September 2021, FIDO2 is a new capability and some 
organisations may not yet have a defined plan for rolling this out to users.
For further guidance, visit the FIDO2 FAQs page.