What Is FIDO and How Does It Work?

Benefits of FIDO

• Higher security: FIDO uses cryptographic methods for authentication, making it much harder for attackers to compromise user accounts.
• Convenience: FIDO eliminates the need for passwords, allowing users to log in with a simple touch or gesture, making the login experience much simpler and more secure.
• Interoperability: FIDO standards are device and platform agnostic, enabling seamless authentication across a wide range of devices and services.
• Better user experience: FIDO provides a more convenient and user-friendly authentication experience compared to traditional methods such as passwords.
• Higher adoption: With FIDO, organisations can improve the security of their systems while providing a better user experience, leading to higher adoption and usage.

How Does FIDO Work?

FIDO relies on standard public key cryptography techniques to replace password authentication. When registering with an online service, a user’s device (mobile phone, tablet, etc.) creates a so-called key pair. The device itself stores the private key while the public key is registered with the respective online service.

During the registration process, users select their authentication method depending on the technical capabilities of their devices. The options include e.g. fingerprint scan, voice recognition, facial recognition, or PIN. These biometric identifiers are safely stored on the user’s device and never shared. Thereafter, authentication is a seamless process. The user’s device proves possession of the private key by signing a so-called challenge. The private key is unlocked via the user’s pre-selected method i.e. fingerprint scan, facial recognition, etc.

FIDO protocols have been devised with user privacy in mind. They do not provide user information that can be exploited by online services to track user behavior and movements across various services.

What Types of FIDO Standards/Protocols Are There?

As mentioned, the FIDO Alliance has created three standards since 2013. Each has its own pros and cons depending on how they are implemented. Let’s take a close look at the different protocols.

Universal Second Factor (U2F)

Rather than completely replacing the password, FIDO U2F protocols works alongside it by asking users to provide two factors to verify their identities:

• Something they know: e.g. a username and password
• Something they have: e.g. a registered fob or security key (e.g. Yubikeys), which are also known as U2F authentication tokens . They may rely on USB, NFC (near-field communication), or Bluetooth technology for the authentication processes.

Once the security key or token has been activated (often by the press of a button on the device), the browser interacts directly with said device to provide access to the online service.

Universal Authentication Framework (UAF)

By contrast, the FIDO UAF protocol allows for a passwordless sign-on experience while also providing a multi-factor (MFA) sign-on option for added security.  It was originally developed with the authenticators on mobile phones (Touch ID, Face ID) in mind. This is the most common authentication method in the financial sector in the United States and Europe.

Users relying on UAF need a computer, smartphone, etc. that they can register with the online service. When registering, users select an authentication method. Depending on the device, the service provider offers a list of possible options i.e. facial or voice recognition, fingerprint scan, or a PIN. For MFA sign-on, the authentication process simply requires more than one of these options. Once a user is registered, they can no longer sign in with a password.

FIDO2

FIDO2 is built with two open standards: the FIDO Client-to-Authenticator protocol (CTAP) and the aforementioned W3C standard WebAuthn (i.e. the World Wide Web Consortium’s Web Authentication specification). Together these standards provide passwordless authentication, or two-factor (2FA) and MFA experiences. They also sometimes rely on embedded authenticators like biometric indicators or hardware authenticators (e.g. fobs or security keys). FIDO2 relies on the following specifications:

• WebAuthn provides the interface for creating and managing public key credentials by defining a standard web API that is built into platforms and browsers. It is able to communicate with all CTAP authenticators.
• CTAP1 provides users with a 2FA experience. It does this by requiring security devices (NFC readers or plug-in keys/fobs) to access online services.
• CTAP2 makes it possible to use the authenticator as both the first and second authentication factor, thereby making passwordless, 2FA, and MFA authentication all possible.

Nevis Products for FIDO