FIDO (Fast Identity Online) protocols

• list federation protocols used along with FIDO2 authentication.

  Federation protocols are used to establish trust between different entities across different systems. FIDO2 is a set of authentication protocols that enable users to securely authenticate with online services. FIDO2 can be used with various federation protocols to provide secure authentication. Some of the federation protocols used with FIDO2 authentication are:

  1. OAuth 2.0: OAuth 2.0 is an open standard authorization protocol that enables applications to access user data on behalf of the user. It is often used in conjunction with FIDO2 to enable users to authenticate to online services.

  2. OpenID Connect: OpenID Connect is an identity layer built on top of OAuth 2.0. It provides authentication and authorization for web applications. FIDO2 can be used with OpenID Connect to enable users to authenticate to online services.

  3. SAML (Security Assertion Markup Language): SAML is an XML-based standard for exchanging authentication and authorization data between parties. FIDO2 can be used with SAML to enable users to authenticate to online services.

  4. WS-Federation (Web Services Federation): WS-Federation is a protocol for federated identity and access management. FIDO2 can be used with WS-Federation to enable users to authenticate to online services.

  5. Shibboleth: Shibboleth is an open-source software package for web single sign-on (SSO). FIDO2 can be used with Shibboleth to enable users to authenticate to online services.

  These are just a few of the federation protocols that can be used with FIDO2 authentication. The choice of protocol will depend on the specific requirements of the system and the preferences of the developers.

• explain passwordless FIDO2 authentication with ctap2 and webauthn API.

  Passwordless FIDO2 authentication with CTAP2 and WebAuthn API involves several steps:

  1. The user initiates the authentication process by visiting a website or application that supports WebAuthn.

  2. The website or application sends a request to the user's device, asking it to provide authentication credentials using the CTAP2 protocol.

  3. The user's device generates a new public-private key pair and sends the public key to the website or application using the CTAP2 protocol.

  4. The website or application creates a challenge and sends it to the user's device using the WebAuthn API.

  5. The user's device signs the challenge with the private key and sends the signed response back to the website or application using the CTAP2 protocol.

  6. The website or application verifies the signed response using the public key that was previously received from the user's device using the CTAP2 protocol.

  7. If the verification is successful, the website or application authenticates the user using the WebAuthn API.

  CTAP2 (Client to Authenticator Protocol version 2) is a protocol that defines how a client, such as a website or application, communicates with a FIDO2 authenticator, such as a security key or a biometric sensor. CTAP2 provides a secure and standardized way for clients to communicate with authenticators, allowing for seamless integration with WebAuthn.

  WebAuthn API is a web authentication standard that provides a platform- and browser-agnostic API for communicating with FIDO2 authenticators, such as security keys or biometric sensors. WebAuthn enables passwordless authentication using public key cryptography and eliminates the need for traditional password-based authentication methods.

  Overall, the combination of CTAP2 and WebAuthn API provides a secure and standardized way for clients to communicate with FIDO2 authenticators, enabling passwordless authentication using public key cryptography. By adopting this approach, websites and applications can provide their users with a convenient and secure authentication experience, while also improving their overall security posture by eliminating the use of weak and easily guessable passwords.

• explain internal authenticator with windows hello

  Windows Hello is a biometric authentication feature in Windows 10 that enables users to sign in to their devices using facial recognition, fingerprint scanning, or a PIN. Windows Hello supports both external and internal authenticators, with internal authenticators being built-in sensors, such as cameras and fingerprint readers, that are integrated into the user's device.

  An internal authenticator with Windows Hello works by capturing and securely storing the user's biometric data on their device. When the user attempts to log in, Windows Hello uses the built-in sensor to capture their biometric data, such as a facial scan or fingerprint, and compares it to the previously stored data to verify their identity.

  Internal authenticators offer several benefits over external ones, including:

  1. Convenience: Internal authenticators are always with the user and do not require any additional hardware or accessories.

  2. Security: Internal authenticators use hardware-based security features, such as secure enclaves, to protect the user's biometric data from unauthorized access or tampering.

  3. Privacy: Internal authenticators keep the user's biometric data on their device, reducing the risk of data breaches or unauthorized access to their personal information.

  Windows Hello supports a variety of internal authenticators, including cameras, fingerprint readers, and infrared sensors. These sensors are typically built into the user's device, such as their laptop or tablet, and are integrated with Windows Hello to provide a seamless and secure authentication experience.

  Overall, Windows Hello's support for internal authenticators provides a convenient, secure, and privacy-enhancing authentication experience for users, while also helping organizations to improve their overall security posture by reducing the risk of password-related attacks and data breaches

• 
  explain passwordless FIDO2 authentication with webauthn.

  WebAuthn is a web authentication standard that enables passwordless authentication using public key cryptography. It is a part of the FIDO2 authentication specification and is supported by most modern web browsers. WebAuthn provides a secure and easy-to-use alternative to traditional password-based authentication methods.

  Passwordless FIDO2 authentication with WebAuthn involves the following steps:

  1. The user initiates the authentication process by visiting a website or application that supports WebAuthn.

  2. The website or application sends a request to the user's device, asking it to provide authentication credentials.

  3. The user's device generates a new public-private key pair.

  4. The user's device sends the public key to the website or application.

  5. The website or application creates a challenge and sends it to the user's device.

  6. The user's device signs the challenge with the private key and sends the signed response back to the website or application.

  7. The website or application verifies the signed response using the public key that was previously received from the user's device.

  8. If the verification is successful, the website or application authenticates the user.

  This process allows for secure and convenient authentication without the need for passwords. Instead, the user relies on their device's built-in security features, such as a biometric sensor or a hardware security key, to securely store their private key and handle the authentication process.

  WebAuthn is an open and interoperable standard that is supported by a growing number of web browsers and web applications. By adopting WebAuthn, websites and applications can provide their users with a secure and seamless authentication experience, while also improving their overall security posture by eliminating the use of weak and easily guessable passwords.

• explain passwordless FIDO2 authentication with ctap.

FIDO2 is a modern authentication standard that aims to replace traditional password-based authentication methods with a more secure and convenient approach. FIDO2 authentication is based on public-key cryptography, which makes it more resistant to various types of attacks, such as phishing and brute-force attacks.

CTAP (Client to Authenticator Protocol) is a protocol that enables communication between a user's device, such as a smartphone or laptop, and an external authenticator, such as a USB security key. CTAP allows the user's device to request and receive authentication credentials from the authenticator, without the need for the user to manually enter a password.

Passwordless FIDO2 authentication with CTAP involves the following steps:

1. The user initiates the authentication process by visiting a website or application that supports FIDO2 authentication.

2. The website or application sends a request to the user's device, asking it to provide authentication credentials.

3. The device communicates with the external authenticator, using the CTAP protocol, to request a public key credential.

4. The authenticator generates a new key pair (public and private keys) and sends the public key to the user's device.

5. The user's device creates a challenge and sends it to the authenticator.

6. The authenticator signs the challenge with the private key and sends the signed response back to the user's device.

7. The user's device verifies the signed response using the public key that was previously received from the authenticator.

8. If the verification is successful, the user's device sends the public key credential to the website or application, which uses it to authenticate the user.

This process allows for secure and convenient authentication without the need for passwords. Instead, the user relies on an external authenticator, such as a USB security key, to securely store their private key and handle the authentication process. 

• Passwordless FIDO2 authentication is a method of authentication that uses FIDO2 (Fast Identity Online) protocols and standards to authenticate users without the need for a password. Instead, the user is authenticated using a hardware security key or biometric authentication, such as a fingerprint or facial recognition.

  Here is how passwordless FIDO2 authentication works:

  1. User initiates authentication: The user navigates to a website or application that supports FIDO2 authentication and initiates the authentication process.

  2. FIDO2 request: The website or application sends a request to the user's FIDO2 security key, asking it to authenticate the user.

  3. User verification: The user is prompted to verify their identity using their hardware security key or biometric authentication.

  4. FIDO2 response: The FIDO2 security key generates a response that is sent back to the website or application, which verifies the user's identity without the need for a password.

  5. Access granted: If the user is successfully authenticated, they are granted access to the website or application.

  Passwordless FIDO2 authentication provides a more secure and convenient authentication method than traditional passwords. Hardware security keys are resistant to phishing attacks and other forms of identity theft, and biometric authentication provides a fast and easy way for users to verify their identity.

  Passwordless FIDO2 authentication is supported by a growing number of websites and applications, including Microsoft Windows 10 and Google Chrome. It is expected to become more widely adopted in the coming years as the need for strong authentication methods continues to grow.

• FIDO 

FIDO Authentication enables password-only logins to be replaced with secure and fast login experiences across websites and apps

https://fidoalliance.org/what-is-fido/#fido-authentication-is-the-answer

How to enable FIDO2 authentication

FIDO2 is an authentication standard hosted by FIDO Alliance. This standard includes the Web Authentication ("WebAuthn") API, which is a specification written by the World Wide Web Consortium (W3C) and FIDO, with participation from additional third parties. The WebAuthn API is backward compatible with Universal 2nd Factor (U2F) keys. 

https://docs.centrify.com/Content/CoreServices/Authenticate/U2FAuth.htm

• Enable FIDO2 authentication

FIDO2 is an authentication standard hosted by FIDO Alliance. This standard includes the Web Authentication ("WebAuthn") API, which is a specification written by the World Wide Web Consortium (W3C) and FIDO, with participation from additional third parties. The WebAuthn API is backward compatible with Universal 2nd Factor (U2F) keys

CyberArk leverages the WebAuthn API to enable passwordless authentication to the CyberArk Identity using either external or on-device authenticators. 

Single-factor FIDO2 authenticators are something you have. Examples are external authenticators like security keys that you plug into the device's USB port; for example, a YubiKey.

Supported multi-factor FIDO2 authenticators are something you are. Popular examples are biometric authenticators integrated into device hardware, such as Mac Touch ID, Windows Hello, and fingerprint scanners.

https://docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/CoreServices/Authenticate/U2FAuth.htm

• FIDO2 is a FIDO framework of specifications designed to replace passwords with credentials that cannot be phished, replayed, or breached when servers are compromised – and to do that without sacrificing user convenience across difference types of devices and clients. 

To activate a FIDO2 credential (e.g., on a security key) users can employ gestures such as the use of PINs, biometrics, or button-pushing. Once the user is authenticated, the specifications enable the authenticator device (which could also be a host computer in its own right) to communicate information about the authentication event to other devices or systems using challenge/response protocols based on Asymmetric Key Cryptography. 

https://ldapwiki.com/wiki/FIDO2

•  detailed information on how FIDO can be integrated with leading federation protocols, namely SAML, OIDC, and OAuth,  including how:

    A SAML Service Provider (SP) requests from the SAML Identity Provider (IDP) that user authentication be FIDO-based.

    A SAML IDP returns a SAML Assertion to the SP indicating that user authentication was performed using FIDO.

    A OIDC RP requests from the OIDC Provider that authentication be FIDO-based.

    An OIDC Provider returns a token to the RP indicating that user authentication was performed using FIDO, and how.

    FIDO could be leveraged in OAuth2 environments for user authentication prior to user consent and authorization to access a protected resource.

https://fidoalliance.org/fido-and-federation-protocols-tech-note/

• The FIDO (Fast IDentity Online) authentication standard defines a fast and secure authentication mechanism for users to access websites and applications.

The FIDO Alliance, with representatives from a range of organizations, develops open and scalable technical specifications that allow people to access websites and apps through a common protocol. This means any company can use FIDO standards to implement technologies, like passkeys, for secure authentication.

A passkey is a FIDO login credential, tied to an origin (website or application) and a physical device. Passkeys allow users to authenticate without having to enter a username, password, or provide any additional authentication factor. This technology aims to replace passwords as the primary authentication mechanism.

How does FIDO create stronger security?

FIDO-based authentication removes many of the problems that stem from password-based authentication, and from authentication that uses traditional second-steps. In particular:

    FIDO authentication uses public key cryptography.

    FIDO helps to ensure that the credentials aren't shared with malicious parties or other parties that do not own the credential

Public key cryptography reduces the threat from potential database breaches. The user registers with a single origin (a site or application), which generates a public-private key pair on the user's authenticator (a physical device). The user's public key is stored by the origin's server, but this alone is useless to an attacker. An attacker cannot derive the user's private key from the data stored on the server, which is required to complete authentication

With FIDO, the user is not responsible for confirming that a website or application is actually who they say they are. Further, the user isn't responsible for ensuring credentials aren't used in the wrong places. FIDO binds each credential to a particular origin, which means the device (not the human) is responsible for correctly identifying the website or application.

What are passkeys?

A passkey is a digital credential that adheres to the FIDO and W3C Web Authentication (WebAuthn) standards. Similar to a password, websites and applications can request that a user create a passkey to access their account.

Passkeys rely on unlocking a device to verify a user's identity. This may be performed with a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern. A user must first register with the origin, to generate their passkey (a public-private key pair).

When they return to the website or app to log in, the user may take the following steps:

    Go to the application.

    Click Sign in.

    Select their passkey.

    Unlock the device to complete the login.

The authenticator generates a signature using the private key. This signature is used to verify the login credential between the origin and the authenticator, using the public key and without revealing the private key.

A user can sign into services on any device with the help of a passkey, regardless of where the passkey is stored. For example, a passkey stored on a mobile phone can be used to sign in to a website on a separate laptop.

How do passkeys work?

Passkeys are created and synchronized through the operating system. Some operating systems may allow automatic synchronization of passkeys between the user's devices, such as an Android phone and ChromeOS device which are signed into the same Google account.

While passkeys are tied to operating systems, a user can use passkeys from their phone when logging into a laptop. As passkeys are built with FIDO and W3C standards, all browsers can adopt them

For example, a user visits site.example on their Chromebook. This user has previously logged into site.example on their iOS device. The user will be prompted to confirm their identity on the iOS device. Typically, site.example will create a new passkey for the user's Chromebook so that for future logins, the phone is no longer required.

Passkeys are end-to-end encrypted, which means that even though Google is responsible for synchronizing them to different Android devices, Google cannot read the passkey or otherwise know that data.

What happens if a user loses their device?

Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager.

That means a users' passkeys go with them when they replace their devices. To sign into apps on a new phone, all users need to do is unlock their phone

Can a user use a passkey on their phone to sign in on a friend's device?

Yes. Users can set up a "one time link" between their phone and someone else's device for the purposes of signing in.

https://developers.google.com/identity/fido

• FIDO consists of three protocols for strong authentication1 to web applications: Universal 2nd Factor (U2F), Universal Authentication Framework (UAF), and FIDO2 or WebAuthn

    The Universal 2nd Factor (U2F) protocol was primarily intended to be a simple protocol and used as a second factor authentication scheme in addition to the first factor (the user's password); while

    The Universal Authentication Framework (UAF) was defined as a password-less protocol for mobile devices only

FIDO2 and W3C Web Authentication (WebAuthn)

Members of the FIDO Alliance, recognizing that the market would logically be better served with a protocol that carried features of U2F and UAF, decided to create a new protocol. This third protocol—referred to as FIDO 2.0 or FIDO2—has JavaScript elements that were submitted to the World Wide Web Consortium (W3C) for standardization, so it can be uniformly implemented in all W3C-compliant browser agents.

While WebAuthn is different from U2F and UAF, it embodies capabilities from each of its predecessors to deliver similar benefits, and even has a compatibility mode with U2F, where U2F authenticators will work with FIDO2 servers when using the WebAuthn specification.

In addition to all the capabilities of the U2F and UAF protocols, WebAuthn's capabilities include:

    Use of Rivest-Shamir-Adelman (RSA) encryption public and private key pairs for the digital signature scheme

    Use of platform authenticators (cryptographic modules built into the computing devices, such as the Trusted Platform Module (TPM) on a desktop/laptop computer, or a Secure Element built into a mobile phone) to generate and protect private keys

    Use of external (or roaming) authenticators such as smart cards, Subscriber Identity Module (SIM) cards, or USB-based cryptographic hardware with HID and BLE transport support

https://blog.strongkey.com/blog/guide-to-fido-protocols-u2f-uaf-webauthn-fido2

• FIDO2 is a joint project by the FIDO Alliance (Fast IDentity Online) and the W3C to provide strong authentication for web applications. Thus, it aims to improve security by reducing or eliminating identity theft through providing passwordless authentication. 

At the core of FIDO2 are cryptographic authenticators which can be hardware security keys connected via USB, NFC, or by being built into (e.g., smartphones). The authenticators are combined with the WebAuthn protocol that defines how web applications, the computer (client), and authenticators interact. It is important to note that the authentication itself is performed by the cryptographic authenticator (the hardware). The computer (client) utilizes the Client to Authenticator Protocol (CTAP).

https://www.ibm.com/cloud/blog/use-your-fido2-key-for-2fa-on-ibm-cloud-apps