# Nitrokey U2F - some way to configure? / FIDO U2F login to local account on QubesOS
**URL:** https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865
**Category:** Nitrokeys
**Created:** [July 18, 2019, 11:11pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865 "2019-07-18T23:11:23Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@michael](https://support.nitrokey.com/u/michael)
#### Post date: [July 18, 2019, 11:11pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/1 "2019-07-18T23:11:23Z")
Hi all,
I am unable to find documentation on how to configure the Nitrokey U2F outside of use with a browser.
My intention is to configure the Nitrokey U2F’s challenge-response mode, similar to how one can use [Yubico’s personalization GUI](https://developers.yubico.com/yubikey-personalization-gui/).
I am trying to use the Nitrokey U2F rather than Yubikey U2F for this set-up (U2F login into OS): [Redirecting…](https://www.qubes-os.org/doc/yubi-key/#challenge-response-mode)
any guidance or help appreciated - thanks and keep up the good work!
---
### Author:  [@szszszsz](https://support.nitrokey.com/u/szszszsz)
#### Post date: [July 23, 2019, 12:06pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/2 "2019-07-23T12:06:44Z")
Hi @michael!
Sorry for delay. Unfortunately Nitrokey U2F does not support challenge-response mode (which needs `HMAC-SHA1` implementation). This is not a part of FIDO U2F standard, but rather more like [HOTP](https://developers.yubico.com/pam-u2f/)/TOTP, but with own challenge.
There is surely a possibility to log in to the OS via the `pam_u2f` module. I do not know though is it available for QubesOS. See following for details:
- [https://github.com/Yubico/pam-u2f](https://github.com/Yubico/pam-u2f)
- [https://developers.yubico.com/pam-u2f/](https://developers.yubico.com/pam-u2f/)
---
### Author:  [@michael](https://support.nitrokey.com/u/michael)
#### Post date: [July 23, 2019, 1:47pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/3 "2019-07-23T13:47:19Z")
thanks for the response! it looks like there are some PAM-based ways of implementing this functionality in Qubes OS:
- [https://github.com/adubois/qubes-app-linux-yubikey](https://github.com/adubois/qubes-app-linux-yubikey)
- [https://old.mig5.net/content/yubikey-2fa-qubes-redux-adding-backup-key.html](https://old.mig5.net/content/yubikey-2fa-qubes-redux-adding-backup-key.html)
I’ll explore this strategy, thanks for the guidance.
---
### Author:  [@newNKuser](https://support.nitrokey.com/u/newNKuser)
#### Post date: [January 11, 2024, 8:38pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/4 "2024-01-11T20:38:23Z")
@szszszsz Does the Nitrokey3A Mini support HMAC-SHA1 challenge response?
@michael did you ever get this to work with a Nitrokey on QubesOS? IIUC the linked articles are both about using a Yubikey in challenge response mode…
---
### Author:  [@bernd](https://support.nitrokey.com/u/bernd)
#### Post date: [January 11, 2024, 10:12pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/5 "2024-01-11T22:12:26Z")
> [@newNKuser](#):
>
> Does the Nitrokey3A Mini support HMAC-SHA1 challenge response?
Don’t know but give it a try…
> [@newNKuser](#):
>
> did you ever get this to work with a Nitrokey on QubesOS? IIUC the linked articles are both about using a Yubikey in challenge response mode…
It shouldn’t matter. Challenge Response is challenge Response… It’s documented on the nk webpage. I wrote about how to set it up on nk3 and a onlykey here: [Using Challenge-Response (HMACSHA1) with the same Secret on a Nitrokey 3 and on a Onlykey to unlock a KeepassXC Database](https://support.nitrokey.com/t/using-challenge-response-hmacsha1-with-the-same-secret-on-a-nitrokey-3-and-on-a-onlykey-to-unlock-a-keepassxc-database/5722) maybe it helps… Spoiler: the nk3 wants to have the secret base32 encoded.
---
### Author:  [@szszszsz](https://support.nitrokey.com/u/szszszsz)
#### Post date: [January 12, 2024, 10:54am UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/7 "2024-01-12T10:54:39Z")
> [@newNKuser](#):
>
> @szszszsz Does the Nitrokey3A Mini support HMAC-SHA1 challenge response?
Yes. All NK3’s should support HMAC-SHA1.
---
### Author:  [@newNKuser](https://support.nitrokey.com/u/newNKuser)
#### Post date: [January 12, 2024, 8:03pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/8 "2024-01-12T20:03:10Z")
> [@szszszsz](#):
>
> Yes. All NK3’s should support HMAC-SHA1.
Thanks, I see the option now under `nitropy nk3 secrets --help`; what I still can’t figure out is how to interact with the NK3 using this mechanism…basically I need some program to issue the challenge and get the response from the NK3, but `nitropy` itself doesn’t have that kind of function, it seems, and `ykchalresp` doesn’t recognize my NK3. Is there a simple command line program available somewhere that can do this?
My use case is to set up the NK3 as a login authenticator on QubesOS4.2, so I need to `qvm-run -p sys-usb someprogram` from dom0 to sys-usb to interact with the NK3…I’m looking for “someprogram”.
Edit: I think `openssl` might do…
Edit: found a different way using passwords
---
### Author:  [@newNKuser](https://support.nitrokey.com/u/newNKuser)
#### Post date: [January 25, 2024, 4:09pm UTC](https://support.nitrokey.com/t/nitrokey-u2f-some-way-to-configure-fido-u2f-login-to-local-account-on-qubesos/1865/9 "2024-01-25T16:09:12Z")
[This PR](https://github.com/QubesOS/qubes-app-yubikey/pull/22) for the `qubes-dom0-yubikey` app works for the QubesOS screen lock (`xscreensaver`) in case anyone is reading this later…it uses HOTP for NitroKey3 devices.