CTAP 2.0 Proposed Standard (September 27, 2017).Client to Authenticator Protocol (CTAP).FIDO 2.0 Proposed Standard (September 4, 2015).FIDO 2.0 (FIDO2, contributed to the W3C on November 12, 2015).UAF 1.1 Proposed Standard (February 2, 2017).UAF 1.0 Proposed Standard (December 8, 2014).Universal Authentication Framework (UAF).The following open specifications may be obtained from the FIDO web site. Both protocols define a common interface at the client for whatever local authentication method the user exercises.

The keys on the device are unlocked by a local user gesture such as a biometric or pressing a button.įIDO provides two types of user experiences depending on which protocol is used. To authenticate the user, the device signs a challenge from the server using the private key that it holds.

The user's device registers the user to a server by registering a public key. Authentication over the wire happens using public-key cryptography.

The specifications emphasize a device-centric model. The USB security token device may be used to authenticate using a simple password (e.g. FIDO addresses the lack of interoperability among devices that use strong authentication and reduces the problems users face creating and remembering multiple usernames and passwords.įIDO supports a full range of authentication technologies, including biometrics such as fingerprint and iris scanners, voice and facial recognition, as well as existing solutions and communications standards, such as Trusted Platform Modules (TPM), USB security tokens, embedded Secure Elements (eSE), smart cards, and near field communication (NFC). The FIDO ('Fast IDentity Online') Alliance is an open industry association launched in February 2013 whose stated mission is to develop and promote authentication standards that 'help reduce the world’s over-reliance on passwords'.

U2f fido2