authenton

What is FIDO2?

FIDO2 is an open authentication standard developed by the FIDO Alliance that provides a secure and easy-to-use alternative to traditional password-based authentication. FIDO2 builds upon the previous U2F and CTAP standards and includes two main components: the WebAuthn API and the CTAP2 protocol.

The WebAuthn API is a browser-based API that allows websites and applications to interact with FIDO2-enabled authenticators for passwordless authentication. The API provides a standardized way for the website or application to communicate with the authenticator, including registering new credentials, authenticating existing credentials, and retrieving metadata about the authenticator.

The CTAP2 protocol is a communication protocol between the client-side software (such as a web browser or a mobile app) and the authenticator (such as the authenton#1 hardware security key) for passwordless authentication. CTAP2 includes several enhancements over the previous CTAP standard, such as support for multiple credentials, improved attestation formats, and support for PIN authentication.

FIDO2 is based on public-key cryptography, where the authenticator generates a public-private key pair and uses it to sign and verify cryptographic operations. The client-side software generates a challenge that the authenticator must sign with its private key to prove its authenticity. The signed response is then sent back to the client-side software for verification, ensuring that the user is in possession of the authenticator and providing a strong form of two-factor authentication.

FIDO2 provides several benefits over traditional password-based authentication. It is resistant to phishing attacks because the user must physically interact with the authenticator to complete the authentication process. It is also resistant to man-in-the-middle attacks because the signed response can only be verified by the relying party that generated the original challenge. Additionally, FIDO2 provides a consistent user experience across different websites and applications that support the standard, making it easy to use and adopt.

FIDO2 has been adopted by several major online services, including Apple, Google, Microsoft, AWS and Dropbox, and is supported by popular web browsers such as Chrome, Firefox, and Edge. The FIDO Alliance continues to develop and promote the FIDO2 standard, along with other passwordless authentication standards, to improve online security and user experience.