CTAP

CTAP, or Client-To-Authenticator Protocol, is a communication protocol defined for the FIDO2 standard that enables a client, such as a web browser or operating system, to interact with a security authenticator. It is designed to support passwordless and phishing-resistant authentication by exchanging cryptographic credentials between the client and a physical or built-in authenticator.

CTAP comprises two generations: CTAP1 and CTAP2. CTAP1, historically aligned with the U2F (Universal 2nd Factor) standard, provides backward-compatible operations for basic authentication with a security key. CTAP2, introduced with FIDO2, extends the protocol to support the full WebAuthn credential creation and assertion workflow, enabling passwordless logins as well as multi-factor scenarios. CTAP2 also supports more advanced features such as user verification and attestation.

Communication via CTAP can occur over several transport channels, including USB, NFC, and Bluetooth Low Energy. The authenticator may be a separate hardware device (a security key) or a built-in platform authenticator embedded in a device’s hardware. The client initiates requests, the authenticator performs cryptographic operations (such as generating and storing key pairs) and returns responses. User presence (such as a touch or button press) is commonly required to complete operations, adding a layer of physical verification.

CTAP contributes to stronger authentication by enabling public-key cryptography and reusable credentials that are resistant to phishing. It also supports interoperability across implementations and is a core component of WebAuthn-enabled authentication workflows.

See also: FIDO2, WebAuthn, U2F, security keys.