Eliminating Passwords: WebAuthn is the official standard for passwordless authentication.WebAuthn provides numerous security benefits compared to traditional, password-based authentication, including: The public key is sent to the website and is used in all future communications. WebAuthn eliminates the need for insecure passwords because it uses asymmetric or public key cryptography to set up a public/private keypair or “credential” for a website. WebAuthn abstracts away the details of the authenticator, so a Relying Party doesn’t need to know the details of how a CTAP-compliant roaming authenticator or a platform authenticator works. WebAuthn provides an interface for communicating between an authenticator and a Relying Party, the service that actually uses this authentication information. However, the browser isn’t the one that needs the authentication information. The CTAP standard secures communication between an external authenticator and an application running on a user’s computer or in the browser.

CTAP can communicate with roaming authenticators over Bluetooth, Near-Field Communications (NFC), or USB. These platform authenticators do not require CTAP to secure their communications.ĬTAP is designed to ensure that communications with roaming authenticators are performed using a secure authentication channel. For example, CTAP can be used to communicate between a Yubikey and a web application running within the browser on a user’s computer.Īuthenticators can also be built into a device, such as fingerprint scanners or facial recognition on a smartphone or computer. What is CTAP?ĬTAP is a standard that enables communication between a “roaming” hardware authenticator and a client application. The FIDO2 protocol is made up of two components: the Client to Authenticator Protocol (CTAP) and the WC3 Web Authentication (WebAuthn) standard. FIDO2 is a collaboration between the FIDO Alliance and the World Wide Web Consortium (W3C) to enable web applications to use strong authentication.

Google titan fido2