CTAP1

CTAP1, or Client-To-Authenticator Protocol 1, is a protocol used in the FIDO U2F (Universal 2nd Factor) framework to facilitate communication between a client (such as a web browser or operating system) and a security key or other authenticator. CTAP1 defines the commands and message formats used during registration and authentication with a relying party, enabling hardware keys to provide a second factor for login.

In practice, CTAP1 is the USB HID-based protocol that carries the U2F operations. The two principal operations are registration and authentication. Registration uses the U2F_REGISTER command to create a new key pair for a given application parameter, typically the SHA-256 hash of the site or origin. Authentication uses U2F_AUTHENTICATE to prove possession of the private key by signing a challenge for the application parameter. During registration, the device may return an attestation certificate to establish the authenticator’s provenance.

CTAP1 messages include a challenge parameter and an application parameter, and the device signs data with its private key on successful completion. A user presence gesture, such as touching the security key, is typically required to complete an operation, providing protection against remote credential theft.

CTAP1 is largely superseded by CTAP2, which underpins WebAuthn and supports multiple transports (USB, NFC, BLE). However, many FIDO U2F devices and browsers still implement CTAP1 for compatibility. The two CTAP generations coexist in the ecosystem, with CTAP2 enabling richer features and a broader ecosystem while CTAP1 remains a foundational U2F protocol.