Enabling your keypad | Logging in | Changing your PIN
Proper handling | Replacing or exchanging keypad

Enabling your keypad

To enable your CRYPTOCard keypad, which will allow you to log in to UCAR resources, you first need to complete the acknowledgement form and fax it to 303-497-1840. You will be called with your personal identification number (PIN) within two business days.

CRYPTOCard keypadWhen you receive your PIN, follow these steps to enable the keypad:

  • Press the PASSWORD button on the keypad to turn it on.
  • Allow one second for the PIN? prompt to appear, then type in your PIN. You will see asterisks instead of numbers as you do this.
  • Press the ENT button.
  • When the display asks New PIN?, type in a 6- to 8-digit number that will be difficult for someone else to guess but that you will be able to remember.
  • Press ENT.
  • When the display says Verify, type your new PIN again and press ENT.

Logging in

To log in to a CISL system—Cheyenne, in this example—use the ssh command and your UCAR username as shown.

ssh -X -l username

The system will prompt you to enter a token response.

Using keyboard-interactive authentication.

To respond:

  • Press PASSWORD on your CRYPTOCard keypad, which then will ask you for your PIN.
  • Type your PIN and press the ENT button. A one-time password (OTP) will appear on the card in a form like this: 311-2300
  • Enter the OTP, including the hyphen, in the  “Token_Response” field on your computer screen. (The numbers may not be visible as you type them. This is normal.)

You can open more than one login session, but you must complete the authentication process for each session before opening another one.

Changing your PIN

If you have reason to believe someone might have learned your PIN, or your local computer has been infected by a virus or malware, change your PIN by following this procedure:

  • Press the CHG KEY button on your CRYPTOCard keypad.
  • Enter your current PIN at the PIN? prompt.
  • Key in the desired PIN at the NEWPIN? prompt, then press ENT.
  • At the VERIFY prompt, key in the desired PIN again and press ENT.

Proper handling of your CRYPTOCard

Here are some tips for taking proper care of this electronic device.

  • Keep it away from magnets, microwaves, electrostatic shock, and X-rays. (Security checkpoints, such as those at airports, are OK.)
  • Do not get it wet.
  • Do not expose it to temperatures below -5 degrees Fahrenheit, above 120 degrees, or above 90 degrees for sustained periods. (Avoid leaving it on your car’s dashboard on a hot day, for example.)
  • Do not bend it or drop it on hard surfaces.
  • Do not carry it in your pants pocket.

Replacing or exchanging your CRYPTOCard

Contact the CISL Help Desk if you need to replace or exchange your CRYPTOCard keypad.

Users who lose or damage a CRYPTOCard keypad or fail to return it when required will be billed $67. The fee can be paid by credit card on the UCAR Payment Web Site or billed to the user's NCAR program number.

You can exchange a CRYPTOCard for a YubiKey authentication token. Include a note with your name and return address and state that you want to swap for a YubiKey. Send the CRYPTOCard via black bag (for Boulder employees) to ML, Computer Room, x2400. For those outside of Boulder, mail the CRYPTOCard to:

UCAR Shipping and Receiving
c/o Computer Room Mesa Lab
3090 Center Green Drive
Boulder CO, 80301

For security reasons, the CISL Help Desk cannot routinely arrange temporary access for users who forget to bring a CRYPTOCard or YubiKey to work. If you are out of town and need emergency access, contact for assistance.


If you return a token intact within three months after having paid for it, we will issue a credit to your credit card or to the NCAR division that paid for the token if you provide a receipt or other documentation that the charge was approved.