What is FIDO2?

Logging onto a website using your user name and password is no longer the best cer­ti­fi­ca­tion method for various reasons. On the one hand, entering personal user in­for­ma­tion is becoming in­creas­ing­ly cum­ber­some due to the ever-in­creas­ing number of services an average person uses. On the other hand, the security of log-in data is in­creas­ing­ly at risk due to cy­ber­crim­i­nals becoming sneakier and more tech­no­log­i­cal­ly advanced. Targeted brute force attacks or seemingly harmless email phishing attacks ac­cu­mu­late so users often don’t even notice that their own login data has already been tapped.

The FIDO2 security standard addresses this problem by enlisting the help of two-factor au­then­ti­ca­tion that uses security keys (FIDO2 keys) and hardware tokens. Thanks to the in­te­gra­tion of the W3C standard WebAuthn, this procedure not only allows encrypted and anonymous log-ins, but also com­plete­ly password-free log-ins. But how exactly do FIDO2 tokens and keys work and what do you need so that you can use this login procedure for your own web ac­tiv­i­ties?

FIDO2 is the latest spec­i­fi­ca­tion of the non-com­mer­cial FIDO Alliance (Fast Identity Online), which was created with the aim of de­vel­op­ing open and license-free standards for secure, worldwide au­then­ti­ca­tion on the World Wide Web. First came FIDO Universal Second Factor (FIDO U2F), then FIDO Universal Au­then­ti­ca­tion Framework (FIDO UAF), meaning that FIDO2 is the third standard to emerge from the alliance’s work.

At its core, FIDO2 consists of the Client to Authen­ti­ca­tor Protocol (CTAP) and the W3C standard WebAuthn, which together enable au­then­ti­ca­tion where users identify them­selves with cryp­to­graph­ic au­then­ti­ca­tors (such as bio­met­rics or PINs) or external au­then­ti­ca­tors (such as FIDO keys, wearables or mobile devices) to a trusted WebAuthn remote peer (also known as a FIDO2 server) that typically belongs to a website or web app.

FIDO2 provides the option of using two-factor au­then­ti­ca­tion, in which the usual username password login is sup­ple­ment­ed by an en­cryp­tion with FIDO2 keys as well as an ad­di­tion­al FIDO2 token (hardware), or a com­plete­ly password-free au­then­ti­ca­tion.

What both variants have in common is that they eliminate the standard user login with user name and password, which isn’t con­sid­ered the most secure, as well as simple two-factor au­then­ti­ca­tions (email, mobile app, SMS): This prevents cyber criminals using typical attack patterns such as man-in-the-middle attacks and phishing from suc­ceed­ing and taking over the user’s account. Even if the log-in data is com­pro­mised, the FIDO2 login will only work with the re­spec­tive hardware token or private key, which is also bound to a dedicated hardware.

The fact that FIDO2 is an open standard makes it easier for software and hardware de­vel­op­ers to implement the standard in their own products so they are able to offer users this very secure login method.

The main goal of FIDO Alliance is to in­creas­ing­ly eliminate passwords on the web. In order to achieve this, the secure com­mu­ni­ca­tion path between the client (browser) and the re­spec­tive web services is first set up or reg­is­tered in order to be per­ma­nent­ly available for later logins. In this process, FIDO2 keys are generated and verified, which provide the basic en­cryp­tion for the logon procedure. The procedure is as follows:

1. The user registers with an online service and generates a new key pair on the device used - con­sist­ing of a private key and a public FIDO2 key.
2. While the private key is stored on the device and is only known on the client side, the public key is reg­is­tered in the web service’s key database.
3. Sub­se­quent au­then­ti­ca­tions are now only possible by ver­i­fi­ca­tion with a private key, which must always be unlocked by a user action. There are various options such as entering a PIN, pressing a button, voice input, or inserting separate two-factor hardware (FIDO2 token). Some operating systems such as Windows 10 and Android can now also act as security tokens them­selves.

The FIDO2 spec­i­fi­ca­tion defines all com­po­nents that are required for the modern au­then­ti­ca­tion procedure.

First and foremost is the re­peat­ed­ly mentioned W3C standard WebAuthn, which allows online services to enable FIDO au­then­ti­ca­tion via a standard Web API (written in JavaScript) that is also im­ple­ment­ed in various browsers and operating systems. Ap­pli­ca­tions that already support the standard declared in March 2019 include Windows, Android, and iOS (version 13 or higher) as well as the following browsers: Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari (version 13 or higher).

The second critical component is the Client to Au­then­ti­ca­tor Protocol (CTAP). This protocol enables the various FIDO2 tokens to interact with the browsers and also to act as au­then­ti­ca­tors. Both the browser used, and the desired hardware token must therefore be able to com­mu­ni­cate via CTAP in order to use this security feature (including password-free login).

This in­tro­duc­tion has briefly explained why password-free or two-factor au­then­ti­cat­ed login pro­ce­dures such as FIDO2 are the future. Compared to the tra­di­tion­al password log-in, they offer a much smaller attack surface for cyber criminals. With the right tools, it’s not difficult for criminals to work out passwords, while they would need the hardware security token to gain unau­tho­rized access to a FIDO2-protected user account. In addition, you can use one FIDO2 token for different web services instead of creating and re­mem­ber­ing different passwords.

The ad­van­tages of FIDO2 au­then­ti­ca­tion at a glance:

Although the FIDO2 process is ad­van­ta­geous in many respects, it also has its weak points: There are currently only a few web services that offer this form of au­then­ti­ca­tion, and this is a basic pre­req­ui­site for their use. If FIDO2 is a pos­si­bil­i­ty for you, make sure to plan for ad­di­tion­al costs for pur­chas­ing external security tokens. Es­pe­cial­ly in companies where each employee needs their own security key, switching to FIDO2 can quickly become an expensive un­der­tak­ing.

Finally, the stan­dard­ized au­then­ti­ca­tion method requires an ad­di­tion­al step compared to an ordinary password log-in if it is im­ple­ment­ed as a com­ple­men­tary component of a two-factor au­then­ti­ca­tion. So, if you log on to one or more services several times a day, FIDO2 might not be one of the most efficient login tech­niques.