Changing a Yubikey 5C NFC PIN
The Security Key is a very powerful cybersecurity device and represents the state-of-the-art in multi-factor authentication (MFA) technology that does not use any passwords. The MFA is supported by the:
- Possession factor – where the physical possession of the Security Key is essential to the authentication process;
- Knowledge factor – where know the PIN to the Security Key is also essential to the authentication process.
Since the Security Keys provided with the SB2 use two different NIST-approved, passwordless authentication protocols, there are two containers for the cryptographic keys used with the protocols. Each container is managed by a separate PIN.
However, StrongKey recommends using the SAME PIN to both containers of the Security Key to reduce the burden on users. As long as the Security Key is safely in the possession of the legitimate user, and the legitimate user is NOT sharing the PIN to the Security Key with anyone, the user will be complying with one of the strictest security policies recommended for access control.
This document outlines the process for changing the two required PINs – one for the PIV certificate and the other for the FIDO credential.
AP1 Prerequisites
- MacOS 13 and above
- Safari 26.0.1
- Yubikey 5C NFC
- Yubico Authenticator Application
- Internet connection
- USB-C port or USB-C-to-USB-A adapter
AP2 Open the Yubico Authenticator Application
To begin, open the Yubico Authenticator application by searching for it with Spotlight (⌘ + Space) or locating it in Finder's Applications folder.
AP3 The Yubico Authenticator Application
When you open the application, it displays the messages 'No Yubikey Present' and 'Insert Your Yubikey'.
Note
If the 'No YubiKey present' message is not visible, expand the application window to ensure all navigation options are clear.
AP4 Insert the Yubikey 5C NFC
Plug the Security Key into the USB-C port.
AP5 Identifying the USB-C Port
Locate the USB-C port—typically found along the edge of the computer, it features a compact design with smooth, rounded corners that set it apart from traditional USB-A ports. The image below shows both a USB-C port and its matching male connector.
AP6 No USB-C Port? No Problem
With the provided USB-A to USB-C adapter, simply plug the USB-A end into the computer and insert the Security Key into the USB-C port.
The provided USB adapter pictured below.
AP7 Changing the Digital Certificate PIN
From the home screen, navigate to the left and select the Certificates option from the menu.
AP8 Change PIN Option
Select the Change PIN option from the Manage menu on the right.
AP9 Enter PIN Information
- In the top field, enter the default PIN: 123456.
- Enter the new PIN in the middle field. The PIN must contain 6 to 8 characters.
- Re-enter the new PIN in the final field to confirm.
AP10 Save New PIN
Click Save. The application returns to the previous screen. If the process is successful, a “PIN changed” notification briefly appears at the bottom of the screen.
AP11 Changing the FIDO Credentials PIN
To update the second PIN, click on the Passkeys menu option to the left.
Note
StrongKey recommends using the same PIN for the Security Key.
AP12 Passkeys Menu
In the Passkeys menu, select Request Access.
AP13 Change PIN Option
Select the Change PIN option located on the right of the screen.
AP14 Enter PIN Information
- In the text field marked Current PIN type in your current PIN. If you have not changed it, it is 123456 by default.
- In the text field marked New PIN enter a new PIN of your choice. It must be a minimum of 6, and up to 63 characters.
- In the text field marked Confirm PIN enter the same PIN you selected.
AP15 Success!
The display will return to the Passkeys menu, and a notification stating "PIN Reset" will briefly appear at the bottom of the screen.