1

As authentication factors, I know the following

  • You are (e.g. Biometrics)
  • You have (e.g. USB)
  • You know (e.g. Password)

If I use a FIDO2 certified fingerprint reader for password-less authentication with user verification required option, can I call it "Two-factor authentication by You Are, and You Have"?

FIDO2 device has Biometric information inside. If the server has no biometric information for authentication, can I call it Biometric authentication?

Improve this question
2
  • 1
    If I swapped out your FIDO2 device could I use another FIDO2 device and your fingerprint to authenticate?
    – Daisetsu
    Mar 26, 2019 at 7:31
  • @Daisetsu You couldn't if you just use another one. If you register your fingerprint into new FIDO2 device, and add it as your FIDO2 token to your account, then you can use it
    – Daichi
    Mar 26, 2019 at 7:42

1 Answer 1

Reset to default
1

Fido2 can be single factor or multi-factor. From WebAuthn (a component of FIDO) Wikipedia page:

"A FIDO2 authenticator may be used in either single-factor mode or multi-factor mode. In single-factor mode, the authenticator is activated by a test of user presence (TUP), which usually consists of a simple button push. In multi-factor mode, the authenticator is activated by either a PIN (something you know) or a biometric (something you are)."

The reason is that Fido2 works by sending a challenge from the server to the client, and the client authenticates by signing that challenge and sending to the server.

Fido2 certified devices require the key to be protected at hardware level. So when a particular key signs the challenge, it proves that it comes from user's device.

A PIN or biometric then acts as the second factor used in authentication.

Both combined make it multi-factor authentication.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.