What is FIDO2 Authentication

FIDO2 is a cutting-edge authentication standard developed by the FIDO Alliance. It replaces traditional password-based logins with stronger security measures by using public-key cryptography to authenticate users.
 
The FIDO2 authentication process eliminates the need for passwords and provides a strong defense against phishing attacks, man-in-the-middle attacks, and credential theft.

Understanding FIDO2 concepts

Passwordless Authentication

FIDO2 keys can act as a first-factor credential by leveraging its passwordless authentication capabilities.

This approach enhances security significantly as it mitigates the risks associated with password-based authentication, such as phishing attacks, credential theft, and password reuse. With FIDO2 keys acting as the first factor, users can authenticate securely without the need to remember complex passwords or worry about their credentials being compromised.

Phishing-Resistance

Combat phishing attempts by using FIDO2’s cryptographic registration process.

When users register a FIDO2 authenticator, such as a security key or biometric device, a unique public-private key pair is generated. The private key remains securely stored on the user’s device, and is never exposed during authentication, making it virtually impossible for attackers to impersonate users.

Biometric Options

Many FIDO2 tokens come with a fingerprint reader that can introduce a biometric authentication element into your authentication processes.

With the integration of fingerprint recognition technology, users can authenticate themselves by simply scanning their fingerprint, adding an extra layer of verification beyond traditional password and passcode-based methods.

Offline Capabilities

FIDO2 authentication can also be used for offline access to Windows Logon and RDP services.

By leveraging FIDO2 for offline access, users can enjoy a secure and convenient authentication experience across a variety of Windows environments without needing to depend on a reliable internet connection.

How does FIDO2 Authentication work?

FIDO2 Authentication operates on the principles of public-key cryptography to provide a secure and seamless login experience. FIDO2 Authentication works using the following steps:

1. First, a user attempts to authenticate. Their FIDO2 Security Key generates a unique public-private key pair. The private key remains securely stored on the user’s device, while the public key is shared with the corresponding application.
2. Second, the server sends an authentication challenge to the device, which the device signs with its private key.
3. Third, the signed response is then sent back to the server, where it is verified using the stored public key.

This cryptographic exchange ensures that the user possesses the correct private key associated with their account.
 

Protocols: CTAP2, WebAuthn and more

There are two key elements that power FIDO2 authentication:

• WebAuthn: WebAuthn is an API implemented in web browsers and other platforms for the purpose of credential creation.
• CTAP2: CTAP2 is what allows authenticator devices to communicate with the WebAuthn enabled browsers and platforms.

FIDO2 Passkeys

FIDO2 authentication is performed with the use of passkeys that perform the authentication procedure using touch, biometrics, and other gestures. There are two types of passkeys:

• Roaming authenticators: Roaming authenticators are hardware devices that operate independently of users’ existing devices. These primarily come in the form of security keys. Users can authenticate themselves through various means, such as inserting a FIDO key and confirming with a button press or utilizing biometric authentication like fingerprints on their smartphones.
• Platform authenticators: These authenticators are embedded in devices like desktops, laptops, and smartphones. To access FIDO-supported services, users must sign in using their device and then authenticate directly through that device, typically using a biometric scan or a PIN.