Authentication Methods vs. Required User Actions

A comparison of common authentication protocols, their security strength, and the specific user action required to complete authentication using a YubiKey 5 series device.

Comparison Table

Authentication Method	Security Strength	Required User Action	Key Characteristics
FIDO2/WebAuthn	Very High	Touch key	Modern passwordless standard. Uses public-key cryptography. Phishing-resistant.
FIDO U2F	Very High	Touch key	Predecessor to FIDO2. Widely compatible. Phishing-resistant.
Passkeys	Very High	Touch key	Implemented via FIDO2/WebAuthn. Allows secure, synced credentials.
OATH (TOTP/HOTP)	High	Enter 6-digit code	Generates time-based (TOTP) or counter-based (HOTP) one-time passwords.
PIV (Smart Card)	High	Enter PIN	Personal Identity Verification standard. Used for desktop login, SSH, and TLS client auth.
OpenPGP	High	Enter PIN	Used for email encryption and digital signatures.
CCID	High	Enter PIN	USB Smart Card protocol. Enables the key to function as a standard smart card.
Yubico OTP	Medium-High	Touch key	Proprietary one-time password. Touching the key causes a unique code to be generated/typed.

Authentication Method

Security Strength

Required User Action

Key Characteristics

FIDO2/WebAuthn

Very High

Touch key

Modern passwordless standard. Uses public-key cryptography. Phishing-resistant.

FIDO U2F

Very High

Touch key

Predecessor to FIDO2. Widely compatible. Phishing-resistant.

Passkeys

Very High

Touch key

Implemented via FIDO2/WebAuthn. Allows secure, synced credentials.

OATH (TOTP/HOTP)

High

Enter 6-digit code

Generates time-based (TOTP) or counter-based (HOTP) one-time passwords.

PIV (Smart Card)

High

Enter PIN

Personal Identity Verification standard. Used for desktop login, SSH, and TLS client auth.

OpenPGP

High

Enter PIN

Used for email encryption and digital signatures.

CCID

High

Enter PIN

USB Smart Card protocol. Enables the key to function as a standard smart card.

Yubico OTP

Medium-High

Touch key

Proprietary one-time password. Touching the key causes a unique code to be generated/typed.

User Action Breakdown

All standard YubiKey protocols require some form of user interaction, e.g., touch or PIN for security reasons.

Touch Key

Protocols: FIDO2, FIDO U2F, Passkeys, Yubico OTP.
How it works: The user physically touches the metal surface of the YubiKey with their finger.
Why it matters: This confirms the user’s physical presence and intent without requiring them to type anything. It is the most user-friendly and secure method for phishing-resistant login.

Enter 6-digit Code

Protocols: OATH (TOTP/HOTP).
How it works: The user taps the key to generate a code, reads the 6 digits from the display (or an app paired with it), and manually types them into the login field.
Why it matters: While secure, this method is slightly less convenient than "Touch key" and requires the user to remember to type the code. It is functionally similar to Google Authenticator.

Enter PIN

Protocols: PIV, OpenPGP, CCID.
How it works: The user touches the key to wake it, then enters a user-defined PIN (usually on the computer’s keyboard) to unlock the cryptographic module.
Why it matters: This adds an extra layer of "something you know" (the PIN) to "something you have" (the key). If the key is lost, the data remains protected by the PIN.

All models in the YubiKey 5 Series support the protocols listed above. The primary difference lies in the physical connector and wireless capabilities:

Model	Connector	NFC Support	Best For
YubiKey 5 NFC	USB-A	Yes	Desktops (USB-A) and Mobile (NFC on Android/iOS).
YubiKey 5C	USB-C	No	Modern laptops and phones with USB-C ports.
YubiKey 5C NFC	USB-C	Yes	USB-C devices plus mobile NFC authentication.
YubiKey 5i	Lightning	No	iOS devices with Lightning ports (iPhone 14 and earlier).
YubiKey 5Ci	Lightning + USB-C	No	Dual connector for Lightning and USB-C devices.
YubiKey 5	USB-A	No	Standard desktop use (older hardware).

Model

Connector

NFC Support

Best For

YubiKey 5 NFC

USB-A

Yes

Desktops (USB-A) and Mobile (NFC on Android/iOS).

YubiKey 5C

USB-C

Modern laptops and phones with USB-C ports.

YubiKey 5C NFC

USB-C

Yes

USB-C devices plus mobile NFC authentication.

YubiKey 5i

Lightning

iOS devices with Lightning ports (iPhone 14 and earlier).

YubiKey 5Ci

Lightning + USB-C

Dual connector for Lightning and USB-C devices.

YubiKey 5

USB-A

Standard desktop use (older hardware).

For mobile authentication (Android/iOS), ensure you select a model with NFC or the correct physical connector (Lightning/USB-C) to match your device. FIDO2 and OATH work seamlessly via NFC on supported mobile apps.