Field Notes

entity

FIDO2

StatusStableReviewdue UpdatedStands on5 sourcesSupportsnotes

FIDO2 is the FIDO Alliance’s second-generation authentication standard set: the combination of the W3C’s WebAuthn browser and platform API with the Alliance’s own Client to Authenticator Protocol (CTAP). Together they let an online service authenticate a user with origin-bound public-key credentials held on a roaming hardware security key or on a built-in platform authenticator, replacing shared secrets such as passwords. The vault treats FIDO2 as an entity rather than a concept because the FIDO Alliance publishes, versions, and revises the specifications: the Alliance controls what the standard is and what it becomes.

From UAF and U2F

The FIDO Alliance was founded in 2012 and published its first generation of specifications in December 2014. UAF 1.0 standardized passwordless authentication from local authenticators, and U2F 1.0 standardized a physical second factor used alongside a password. Both required per-platform client plumbing, which limited deployment to the largest vendors. The FIDO2 project reworked this architecture: U2F 1.2 became the CTAP1 subprotocol for backward compatibility, a new CTAP2 protocol carried richer operations, and the browser-facing API moved into the W3C as WebAuthn.1 CTAP 2.0 was published as a Proposed Standard on 30 January 2019, and WebAuthn Level 1 became a W3C Recommendation on 4 March 2019.

The two halves

FIDO2 is deliberately split at the platform boundary:

WebAuthn (W3C) CTAP (FIDO Alliance)
Speaks to The web application, via JavaScript The authenticator, over USB, NFC, or BLE
Defines The credential creation and assertion ceremonies, data structures, attestation formats, and the origin (RP ID) binding The wire protocol between platform and authenticator, credential storage, and PIN and user-verification handling
Versioned as Levels 1–3 CTAP1, 2.0, 2.1, 2.2, 2.3

The split means the browser-facing API is governed by the W3C’s Recommendation process while the authenticator protocol stays under the Alliance, whose members also build the hardware. An authenticator implementing CTAP2 is a FIDO2 authenticator; one implementing CTAP1 as well stays compatible with U2F-era services.1

Credentials and attestation

Registration creates a fresh key pair per relying party: the service stores the public key and credential identifier, and the private key never leaves the authenticator. Because the credential is bound to the relying party’s origin, a phishing site on another origin cannot replay or solicit it, which is the property that makes FIDO2 authentication phishing-resistant in a way passwords and one-time codes are not. Attestation lets the authenticator sign a statement about its own make and model during registration, so a service that cares — an enterprise mandating certified hardware — can verify what it is talking to; consumer services usually request no attestation to avoid tracking users by device.

Discoverable credentials and passkeys

CTAP1-era credentials were non-discoverable: the key pair was derived from or wrapped in the credential identifier, so the service had to present that identifier before the key could be used, and nothing was stored on the authenticator. CTAP2 added discoverable credentials — also called resident keys — which are stored on the authenticator itself and can be found without a hint, enabling usernameless sign-in. From 2022 the major platform vendors adopted this mechanism under the consumer name passkeys: Apple, Google, and Microsoft jointly committed to the expanded FIDO sign-in model in May 2022, and platform credential managers began syncing discoverable credentials across a user’s devices.2 A passkey is therefore not a new protocol but a discoverable FIDO2 credential, in either a synced form inside a phone or cloud account or a device-bound form on a security key from Yubico or another vendor.

Versions and governance

CTAP 2.1 (June 2021, errata 2022) added credential management, biometric enrollment, minimum PIN length enforcement, and enterprise attestation, aimed at managed deployments.3 CTAP 2.2 became a Proposed Standard in 2025, adding hybrid transports for cross-device sign-in, persistent read-only credential-management tokens, PIN complexity policy, and a third-party payment extension.1 CTAP 2.3 was published as a Proposed Standard on 26 February 2026 and is the current version; the corresponding WebAuthn Level 3 is completing the W3C Recommendation track. Version numbering and publication rest with the Alliance, and conformance is enforced through its certification program rather than through any regulator.

  1. FIDO Alliance, Client to Authenticator Protocol v2.3 Proposed Standard, 26 February 2026. ↩↩↩

  2. FIDO Alliance, “Passkeys”. The standards body’s own promotional overview, which is authoritative for what the model is and interested in how widely it is adopted. Living page, unsnapshotted. ↩

  3. FIDO Alliance, FIDO2 enhancements for enterprise and complex security applications, June 2021. ↩

Built on 5 sources (5 external).

Working out connections…