K40+ USB-C NFC PIV Security Key

The FEITIAN K40+ is a USB-C and NFC security key that combines FIDO2 and FIDO U2F with Smart Card PIV, OATH-HOTP/TOTP and OpenPGP in one device. It suits businesses, government contractors and privileged users who need phishing-resistant sign-in for cloud accounts plus smart card credentials for servers, networks and applications.

The ePass FIDO NFC Plus USB-C Security Key, model K40+ provides a secure, phishing-resistant authentication scheme to web applications. Unlike the traditional second-factor authentication devices, FIDO Security Keys provides a much more convenient solution to add another security layer on traditional password authentication scheme.

Interested in bulk orders? Reach out to our team at sales@ftsafe.us for volume discounts.

A single key can protect unlimited accounts across multiple websites. The public key infrastructure behind FIDO provides strong cryptographic protection against attacks. Each application will be assigned an individual key pair to preserve user’s privacy.

The embedded high-performance NXP security element also helps to provide random and strong key pairs generated for FIDO authentication and protect user's private information against multiple security threats.

• Works with: Windows Log-In, Twitter, Google Accounts, Microsoft Accounts, Facebook, Salesforce, Zoho, Dropbox, DUO Security, Microsoft Azure Entra ID, Microsoft Active Directory, Coinbase, Bank of America, Okta, Ping Identity, eBay, and many more websites, applications, computers, laptops and devices that accept USB Security Keys.

Features:

• Dual interface: Both USB-C and NFC communication
  
• One key supports multiple services: Interoperates out-of-the-box with hundreds of services that support FIDO U2F and FIDO2
• FIPS-140-2 L2 Certified + Physical Security L3 Certified #4422
• Supports Passwordless authentication on Azure Active Directory and Microsoft Services
• Compliant with Google Advanced Protection Program
  
• Site Specific Keys: Secrets are not shared among service providers. No phishing or man-in-the-middle
• Supported OS: Android, Chrome OS, Windows, MacOS, Linux
• Plug and Play: Identified as a USB HID device
• Fits nicely on a keychain or in a wallet
  
• Model: K40+
• Maximum Residential Credentials: 44
• Slots: 2
• OATH-HOTP, OATH-TOTP
• OpenPGP
• Smart Card PIV: RSA 1024, RSA 2048, ECC P256, ECC P384
• Open PGP: RSA 1024, RSA 2048
• FIDO: AES, ECDSA, SHA256

• Dimensions: 51 x 19 x 7 mm

• Weight: 7.2 gram

Warranty: This product comes with a 1-year warranty from the date of purchase. 

Resources:

• Product Manual
• Data Sheet
• PIV Related Resources

Supports PIV credential authentication for logical and physical access for Government employees and contractors or privileged users to access servers, networks, and applications. 

What is PIV?

A Personal Identity Verification (PIV) credential is a US Federal governmentwide credential used to access Federally controlled facilities and information systems at the appropriate security level.

PIV credentials have certificates and key pairs, pin numbers, biometrics like fingerprints and pictures, and other unique identifiers. When put together into a PIV credential, it provides the capability to implement multi-factor authentication for networks, applications, and buildings.

This is the process of creating and using a government-wide secure and reliable form of identification for federal employees and contractors, in support of HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors.

Source: https://csrc.nist.gov/Projects/piv

Compatibility and use cases

• Connectors: plugs into USB-C computers and taps on NFC-enabled phones. Supported OS: Android, Chrome OS, Windows, macOS and Linux.
• Cloud and workforce sign-in: Microsoft Azure Entra ID, Microsoft Active Directory, Microsoft Accounts, Google Accounts, Okta, Ping Identity and DUO Security, plus hundreds of other FIDO2 and FIDO U2F services.
• PIV smart card credentials: logical and physical access for government employees, contractors and privileged users (RSA 1024, RSA 2048, ECC P256, ECC P384).
• Legacy systems: OATH-HOTP and OATH-TOTP one-time codes across 2 slots, and OpenPGP (RSA 1024, RSA 2048) for signing and encryption.

Frequently Asked Questions

Does the K40+ work with Microsoft Entra ID, Okta and Google?

Yes. FEITIAN lists Microsoft Azure Entra ID, Microsoft Active Directory, Okta, Ping Identity, DUO Security and Google Accounts among the services the K40+ works with. It supports passwordless authentication on Azure Active Directory and Microsoft services and is compliant with the Google Advanced Protection Program.

Does the K40+ work with Android phones and other mobile devices?

Yes. The K40+ has NFC, so it works with NFC-enabled phones by tapping the key, and Android is one of its supported operating systems. It also plugs directly into devices with a USB-C port.

How many passkeys can the K40+ store?

The K40+ stores up to 44 resident credentials, which are passkeys kept on the key itself. A single key can also protect unlimited accounts that use non-resident credentials, with a separate key pair for each application.

Do I need two K40+ keys?

Yes. Register at least two keys per person from day one: one for daily use and one stored safely as a backup. If a key is lost, you sign in with the backup key and remove the lost key from your account, so you never need a weaker fallback method.

What is the difference between the K40+ and the K40?

Both keys use USB-C and NFC and support FIDO2, FIDO U2F, OATH-HOTP and OATH-TOTP. The K40+ adds Smart Card PIV and OpenPGP and stores 44 resident credentials, compared with 26 on the K40. Choose the K40 if you only need FIDO2 and one-time codes.

Further reading: which security key protects against account takeovers, best FIDO security keys for MFA, and all USB-C FIDO security keys.