FIDO2

As explained in Real-World Cryptography

FIDO2 is an open standard that defines how asymmetric keys and hardware authenticators can be used to authenticate users.

When a server already has a secure connection, it can send a random challenge for the client to sign. FIDO2 applies this asymmetric-key approach to user authentication, specifically targeting phishing; replaying an old signature does not answer the new challenge. section 11.2.4

FIDO2 divides the authentication system into two cooperating specifications:

• CTAP lets clients communicate with roaming authenticators, such as external hardware connected to a main device. section 11.2.4
• WebAuthn lets web browsers and web applications authenticate users with hardware authenticators. section 11.2.4
• Authenticators generate and store signing keys, then sign challenges when requested. section 11.2.4

Figure 11.12 To authenticate without using a password, applications can allow users to either use symmetric keys via OTP-based protocols or use asymmetric keys via the FIDO2 standard. FIDO2 supports different types of authenticators, roaming authenticators (via the CTAP standard) or built-in authenticators.

Compare passwordless authentication choices: one-time passwords use symmetric keys, while FIDO2 uses asymmetric keys and supports roaming or built-in authenticators. section 11.2.4

Roaming and built-in authenticators

A YubiKey represents a roaming authenticator, while Touch ID represents a built-in authenticator. Both can provide hardware-backed signing for FIDO2 authentication. section 11.2.4

How Real-World Cryptography covers it

How deep it goes

Defines the challenge-signing model and separates responsibilities between CTAP and WebAuthn, without implementation-level detail.

Examples

Uses YubiKey as a roaming-authenticator example and Touch ID as a built-in-authenticator example.

What it assumes

Assumes familiarity with asymmetric keys, signatures, secure connections, and random challenges.

What you can do after

Apply it via WebAuthn for web authentication or CTAP for communication with external authenticators.

How it connects

Connects asymmetric keys, hardware authenticators, CTAP, WebAuthn, phishing attacks, and one-time-password authentication.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• WebAuthnhas part · WebAuthn is a web authentication standard and browser API that enables public-key authentication using credentials managed by platform or external authenticators.
• open standardkind of · An open standard is a publicly available technical specification developed through an open process and implementable by independent parties.
• phishingaddresses · Phishing is a social-engineering attack that uses deceptive communications or content to impersonate a trusted source and induce disclosure of information or another unsafe action.
• multifactor authenticationused by · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.