Types of token devices

Several types of RSA SecurID token devices are supported for use with IBM® Multi-Factor Authentication for z/OS®.

RSA SecurID card-style tokens and key fobs

These devices generate a token code. Card-style tokens (such as the RSA SecurID 200) and key fobs (such as the RSA SecurID 800) function identically, with both displaying the token code in the LCD.

RSA SecurID PINpads

With an RSA SecurID PINpad token, you enter your PIN directly into the token, and the token generates a hash-encrypted six- or eight-digit passcode. For example, with the RSA SecurID 520 card-style PINpad, you enter the PIN via a 10-digit numeric pad that is contained on the card. The passcode displayed is a hash-encrypted combination of the PIN and the current token code.
You can use the PINpad token in two ways:
  • If you have a valid PIN, enter the PIN and the token generates a hash-encrypted passcode. The passcode displayed is a hash-encrypted combination of the PIN and the current token code. The passcode can be six or eight digits, depending on the profile.
  • If you do not have a valid PIN, which can occur if the security administrator forces you to change it, use the token to generate a token code. You then use the generated token code to log in and change your PIN.

RSA SecurID soft tokens

RSA SecurID soft token applications reside on a computer or other smart device.
You can use the soft token application in two ways:
  • If you have a valid PIN, enter the PIN and the token generates a hash-encrypted passcode. The passcode displayed is a hash-encrypted combination of the PIN and the current token code. The passcode can be six or eight digits, depending on the profile.
  • If you do not have a valid PIN, which can occur if the security administrator forces you to change it, use the token to generate a token code. You then use the generated token code to log in and change your PIN.
Support for MVS™ operator console logon

The MVS operator console logon does not support hard tokens. The MVS operator console logon does support soft tokens.