17

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:

  • FIDO: First iteration in creating a cross industry standard for passwordless / 2fa experience (with UAF and U2F)
  • FIDO2: Second iteration (with CTAP and Webauthn)
  • U2F: specifies a Javascript API and a HID protocol for FIDO
  • CTAP: specifies a HID protocol for FIDO2
  • Webauthn: specifies a Javascript API for FIDO2

Do you think this is accurate? Any other information you think is useful?

2
  • 1
    This article seems to have a pretty good summary of the various standards: blog.strongkey.com/blog/…
    – natevw
    Mar 20, 2021 at 0:38
  • @natevw additionally the article explains the difference between FIDO UAF and FIDO(1),FIDO2
    – kinafu
    Dec 7, 2023 at 10:09

1 Answer 1

6

You are right except for few points to let me break it down for you.

  • FIDO: First iteration in creating a cross-industry standard for passwordless / 2fa experience (with UAF and U2F) ---> Yes you are right about but remember FIDO 1.0 never achieved standardization

  • FIDO2: Second iteration (with CTAP and Webauthn) --> Partially right about FIDO2.0. It comprised of WebAuthn (the Browser API) W3C standard and CTAP2 (the authenticator API) (formally known as U2F/CTAP1) and also FIDO Alliance relabeled U2F as CTAP1. Quite confusing but yeah we have to live with it.

  • U2F: specifies a Javascript API and a HID protocol for FIDO --> Yes you are right

  • CTAP: specifies a HID protocol for FIDO2 --> Yes you are right. CTAP is like client-side protocol to establish communication with external security keys.

  • Webauthn: specifies a Javascript API for FIDO2 --> Perfect
1
  • "CTAP2 (the authenticator API) (formally known as U2F/CTAP1) and also FIDO Alliance relabeled U2F as CTAP1" - are you saying that CTAP2 is known as U2F/CTAP1, and U2F is relabeled as CTAP1, so U2F/CTAP1 is essentially CTAP1 so CTAP2 is known as CTAP1? Oct 17, 2022 at 9:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .