The following open specifications may be obtained from the FIDO web site.4
The U2F 1.0 Proposed Standard (October 9, 2014) was the starting point for the specification known as FIDO 2.0 Proposed Standard (September 4, 2015). The latter was formally submitted to the World Wide Web Consortium (W3C) on November 12, 2015.6 Subsequently, the first Working Draft of the W3C Web Authentication (WebAuthn) standard was published on May 31, 2016. The WebAuthn standard has been revised numerous times since then, becoming a W3C Recommendation on March 4, 2019.
Meanwhile the U2F 1.2 Proposed Standard (July 11, 2017) became the starting point for the Client to Authenticator Protocol 2.0 Proposed Standard, which was published on September 27, 2017. FIDO CTAP 2.0 complements W3C WebAuthn, both of which are in scope for the FIDO2 Project.
The FIDO2 Project is a joint effort between the FIDO Alliance and the World Wide Web Consortium (W3C) whose goal is to create strong authentication for the web. At its core, FIDO2 consists of the W3C Web Authentication (WebAuthn) standard and the FIDO Client to Authenticator Protocol 2 (CTAP2).7 FIDO2 is based upon previous work done by the FIDO Alliance, in particular the Universal 2nd Factor (U2F) authentication standard.
Taken together, WebAuthn and CTAP specify a standard authentication protocol8 where the protocol endpoints consist of a user-controlled cryptographic authenticator (such as a smartphone or a hardware security key) and a WebAuthn Relying Party (also called a FIDO2 server). A web user agent (i.e., a web browser) together with a WebAuthn client form an intermediary between the authenticator and the relying party. A single WebAuthn client Device may support multiple WebAuthn clients. For example, a laptop may support multiple clients, one for each conforming user agent running on the laptop. A conforming user agent implements the WebAuthn JavaScript API.
As its name implies, the Client to Authenticator Protocol (CTAP) enables a conforming cryptographic authenticator to interoperate with a WebAuthn client. The CTAP specification refers to two protocol versions called CTAP1/U2F and CTAP2.9 An authenticator that implements one of these protocols is typically referred to as a U2F authenticator or a FIDO2 authenticator, respectively. A FIDO2 authenticator that also implements the CTAP1/U2F protocol is backward compatible with U2F.
The invention of using a smartphone as a cryptographic authenticator on a computer network is claimed in US Patent 7,366,913 filed in 2002.
16
"Password-The Security Issue That the Big Leaders Want to Eliminate". 30 June 2020. https://www.envzone.com/why-big-tech-is-striving-for-the-world-without-password/ ↩
"Specifications Overview". FIDO Alliance. Retrieved 31 October 2014. https://fidoalliance.org/specifications ↩
"Download Specifications". FIDO Alliance. 23 December 2014. Retrieved 13 February 2019. https://fidoalliance.org/specifications/download/ ↩
"FIDO 2.0: Overview". fidoalliance.org. Retrieved 2021-01-21. https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-overview-v2.0-rd-20170927.html ↩
"Submission Request to W3C: FIDO 2.0 Platform Specifications 1.0". World Wide Web Consortium (W3C). Retrieved 12 February 2019. https://www.w3.org/Submission/2015/02/ ↩
"FIDO2: Moving the World Beyond Passwords". FIDO Alliance. Retrieved 30 January 2019. https://fidoalliance.org/fido2/ ↩
Balfanz, Dirk; Czeskis, Alexei; Hodges, Jeff; Jones, J.C.; Jones, Michael B.; Kumar, Akshay; Liao, Angelo; Lindemann, Rolf; Lundberg, Emil (eds.). "Web Authentication: An API for accessing Public Key Credentials Level 1". World Wide Web Consortium (W3C). Retrieved 30 January 2019. https://www.w3.org/TR/webauthn/ ↩
Brand, Christiaan; Czeskis, Alexei; Ehrensvärd, Jakob; Jones, Michael B.; Kumar, Akshay; Lindemann, Rolf; Powers, Adam; Verrept, Johan, eds. (February 27, 2018). "Client to Authenticator Protocol (CTAP)". FIDO Alliance. Retrieved 30 January 2019. https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html ↩
"FIDO 1.0 Specifications Published and Final". FIDO Alliance. 9 December 2014. Retrieved 31 December 2014. https://fidoalliance.org/news/item/fido-1.0-specifications-published-and-final ↩
"Computerworld, December 10, 2014: "Open authentication spec from FIDO Alliance moves beyond passwords"". Computerworld. 9 December 2014. Retrieved 10 December 2014. http://www.computerworld.com/article/2857656/open-authentication-spec-from-fido-alliance-moves-beyond-passwords.html ↩
"eWeek, July 1, 2015: "FIDO Alliance Extends Two-Factor Security Standards to Bluetooth, NFC"". eWeek. July 2015. Retrieved 1 July 2015. https://www.eweek.com/security/fido-alliance-extends-two-factor-security-standards-to-bluetooth-nfc ↩
"W3C Member Submission 20 November 2015: FIDO 2.0: Web API for accessing FIDO 2.0 credentials". W3C. Retrieved March 14, 2016. https://www.w3.org/Submission/2015/SUBM-fido-web-api-20151120/ ↩
"History of FIDO Alliance". 22 December 2014. https://fidoalliance.org/overview/history/ ↩
"FIDO Alliance Member Companies & Organizations". FIDO Alliance. 3 December 2017. Retrieved 2024-03-22. https://fidoalliance.org/members/ ↩