Published on 25 June 2025

Security keys

Security keys are cryptographically protected credentials. AGOV only permits those with non-extractable hardware binding. They are stored either on an external device (e.g. a FIDO2 USB stick) or as so-called hardware-bound passkeys on the secure chip of the end device. Such security keys can be used via the WebAuthn standard for secure authentication in web applications.

Security keys that can be used in AGOV

• What does FIDO stand for and where are FIDO security keys used?

  FIDO stands for Fast IDentity Online. It is a set of open, licence-free standards and protocols from the FIDO Alliance for secure and user-friendly online authentication. There are various types of FIDO implementations, including FIDO U2F (Universal Second Factor) and FIDO2, which are widely used in modern web browsers and platforms. The protocols enable password-free, phishing-resistant two-factor authentication based on public key cryptography.

• Why do we support the use of security keys (FIDO2)?

  If you want or need to work with AGOV without a smartphone, security keys are the alternative to the AGOV access app. This also applies to people whose smartphones do not support the AGOV access app (wrong operating system, outdated device, hardware without security elements, unauthorised modification due to rooting or jailbreak).

  AGOV uses security keys as a very secure form of two-factor authentication. The physical key is the first factor, while the PIN or biometric verification is the second factor for key usage. In addition, we recommend that all users of the AGOV access app link a security key to their AGOV account. You can do this at https://agov.ch/me. In this way, you ensure that you retain access to AGOV if you lose the recovery code and your smartphone is defective or lost, or if a smartphone change has not been carried out correctly (simply transferring the app is not sufficient for this; please consult Tips for AGOV users). Even if you have the recovery code, additional login factors such as security keys are useful, as a new identity check needs to be carried out in AGOV if only the recovery code is used.

• Why does AGOV only support FIDO2 security keys with Level 2 certification or higher?

  AGOV enforces strict requirements for authentication security – especially when accessing government online services that require high protection. For logins at the “high” level of assurance (Level of Assurance 3, LOA3), mandatory requirements apply in accordance with ICT directive Si001 – ICT Baseline Protection in the Federal Administration.

  • What does FIDO2 Level 2 (L2) mean and why is it required?
    FIDO2 Level 2 (L2) is a certified security level that imposes additional requirements for protecting sensitive authentication data. Unlike Level 1, L2-compliant security keys must include a dedicated secure element. This secure element protects cryptographic material from both physical and software-based attacks - even if the end device is compromised.
    Only with this demonstrably robust protection does an authenticator meet the conditions for use in the federal administration context at the “high” level of assurance (LOA3).
  • Why is a FIDO2 Level 1 key not sufficient?
    FIDO2 Level 1 also permits purely software-based authenticators or devices without specific hardware protection. These provide basic protection, but no verified defense against attacks within the same system context (e.g. on a compromised operating system).
    According to ICT directives, AGOV explicitly requires certified hardware protection, such as that provided by FIDO2 Level 2 or higher.
  • What about open-source security keys without certification?
    Security keys such as the Nitrokey 3A mini may technically meet high security standards. However, without formal certification, the required official proof is missing. For AGOV, FIDO certification is a prerequisite, as it documents compliance with security requirements in a traceable and standardized manner.
    Not certified does not automatically mean insecure - but not certified means: not evaluated according to AGOV's mandatory criteria.

  Summary

  Criterion	FIDO2 Level 1	FIDO2 Level 2 (AGOV requirement)
  Protection of authentication data	optional / software-based	Hardware-based (Secure Element)
  FIDO2 certification	yes, basic level	yes, with enhanced protection profile
  Approved for use in AGOV	no	yes

• 1.6 Why don’t synchronizable passkeys work with AGOV?

  Passkeys are a modern and secure method for passwordless authentication, where a cryptographic key is stored on the user’s device.
  
  However, for security and regulatory reasons, AGOV only allows cryptographic keys that are stored locally on a security chip* -for example, on a FIDO2 security key or directly on the device itself.
  
  Passkeys that are synchronized across multiple devices via cloud services such as iCloud or Google are considered less trustworthy, as they can potentially be exported. To ensure the origin and integrity of the keys at all times, AGOV only accepts hardware-bound keys that cannot be transferred, exported, or synchronized. The AGOV access app and the swiyu app for the Swiss e-ID already fully meet these requirements.

  _{* By “security chip” we refer to dedicated, non-exportable storage units for keys, such as Trusted Platform Modules (TPM), Apple’s Secure Enclave, Google’s Titan M, or the security modules used in FIDO2 security keys.}

• Where can I get a security key and at what cost?

  Security keys (FIDO2) should be purchased by the end users themselves from electronics retailers. Depending on the manufacturer and type (connection type, PIN, biometric), these cost between CHF 20 and CHF 120.

• Why does my security key (FIDO2) not always work on Mac?

  Apple only supports FIDO2/WebAuthn standards where it fits into their ecosystem.
  
  In practice, this leads to incompatibilities or limitations, especially when using third-party hardware or browsers. Formally, Apple adheres to the standards - but not with the openness or depth of Microsoft or Linux.

  Everyday recommendations, including AGOV

  To login with a FIDO2 security key on a macOS computer at agov.ch, we recommend using Google Chrome (or Microsoft Edge) on your Mac. These browsers provide the most reliable support for FIDO2/WebAuthn technology, especially when used with USB security keys or Touch ID. Firefox is not recommended as it may experience limitations or malfunction when using FIDO2 on macOS. Safari also offers limited support.
  Therefore, please use Chrome for registration and login with FIDO2 on agov.ch.

• List of compatible security keys that can be used in AGOV.

  All FIDO2 security keys that meet the following filter criteria are compatible with AGOV:
  - Protocol = fido2
  - Certification = FIDO_CERTIFIED_L2
  - Key Protection = hardware
  
  The following list is available in English only, and the above-mentioned filter criteria must be set by yourself.

  → FIDO MDS Explorer (opotonniee.github.io)

  Disclaimer:
  The listed FIDO2 security keys should be compatible with AGOV but have not been tested. The proper functioning of untested FIDO2-compatible security keys cannot be guaranteed.

You need a security key that supports FIDO2/WebAuthn. Below is a list of FIDO2 security keys that have been successfully tested with AGOV so far.

Token2 T2F2-NFC-Slim

PRODUCT DESCRIPTION:Token2 T2F2-PIN+ NFC-Slim
PROTECTION: Integrated touch button with PIN
CONNECTION POSSIBILITIES: NFC, USB-A / USB Typ-C 
PRICE: CHF approx. 21.00
SUPPORT: FIDO2/WebAuthn, U2F and TOTP/HOTP
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«Token2 T2F2-NFC-Slim»}

Token2 T2F2-Bio2

PRODUCT DESCRIPTION:Token2 T2F2-Bio2
PROTECTION: Fingerprint reader with PIN
CONNECTION POSSIBILITIES: USB-A / USB-C 
PRICE: CHF approx. 36.00
SUPPORT: FIDO2/WebAuthn, U2F and TOTP (with companion app)
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«Token2 T2F2-Bio2»}

Identiv uTrust FIDO2 NFC

PRODUCT DESCRIPTION: Identiv uTrust FIDO2 NFC
PROTECTION: Integrated touch button with PIN
CONNECTION POSSIBILITIES: NFC / USB-A / USB-C 
PRICE: CHF approx. 36.00
SUPPORT: FIDO2/WebAuthn, U2F and TOTP/HOTP 
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«Identiv uTrust FIDO2 NFC»}

Swissbit iShield Key (FIDO2 / Pro)

PRODUCT DESCRIPTION: Swissbit iShield Key (FIDO2 / Pro)
PROTECTION: Integrated touch button with PIN
CONNECTION POSSIBILITIES: NFC / USB-A / USB-C 
PRICE: CHF approx. 52.00 - 85.00
SUPPORT: FIDO2/WebAuthn, U2F, TOTP/HOTP and PIV (version Pro)
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«Swissbit iShield Key»}

YubiKey Security Key Series

PRODUCT DESCRIPTION: YubiKey Security Key Series
PROTECTION: Integrated touch button with PIN
CONNECTION POSSIBILITIES: NFC / USB-A / USB-C
PRICE: CHF 35.00 - 65.00
SUPPORT: FIDO2/WebAuthn and U2F
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«YubiKey Security Key Series»}

YubiKey Bio Serie

PRODUCT DESCRIPTION: YubiKey Bio Serie
PROTECTION: Fingerprint reader with PIN
CONNECTION POSSIBILITIES: USB-A / USB-C
PRICE: CHF 100.00 - 120.00
SUPPORT: FIDO2/WebAuthn and U2F
_{To find sources of supply, enter the following in the internet search engine of your choice:
«YubiKey Bio Serie»}

FIDO2 Smart Card

PRODUCT DESCRIPTION: Cryptnox FIDO2 Card  
PROTECTION: PIN
CONNECTION POSSIBILITIES: Smart Card-Reader and NFC 
PRICE: CHF approx. 40.00
SUPPORT: FIDO2/WebAuthn, U2F and RFID Mifare Desfire EV2 4K
_{To find sources of supply, enter the following in the internet search engine of your choice: 
«Cryptnox FIDO2 Card». Cryptnox offers a FIDO2 Card mangaer app for the iPhone.}

Important:

If you no longer have a login factor for your AGOV login, e.g. due to loss or defect, you will lose all access via AGOV and will have to complete the complex recovery process in AGOV. Avoid this by also registering one or more additional mobile device(s) in your AGOV account with the AGOV access app or an additional security key (FIDO2).