CTAP2

CTAP2, or Client To Authenticator Protocol 2, is a core protocol in the FIDO2 standard that enables a client, such as a web browser or operating system, to communicate with a security authenticator. It expands on the earlier CTAP1/U2F approach to support the full WebAuthn framework, allowing credential creation (MakeCredential) and authentication (GetAssertion), as well as credential and device management features. CTAP2 is designed to work with both roaming authenticators (external keys) and platform authenticators built into devices.

The protocol operates over CTAPHID, the transport layer used for communication between the client and the authenticator. CTAPHID can run over USB, NFC, and Bluetooth Low Energy, enabling use across different connection types. CTAP2 messages are CBOR-encoded and structured to carry a set of commands, including GetInfo (to reveal the authenticator’s capabilities), MakeCredential, GetAssertion, and client-side operations like ClientPIN for secure PIN verification. The GetInfo response details supported transports, cryptographic algorithms, attestation formats, and other capabilities.

Security features are central to CTAP2. The protocol supports user verification methods (for example, PIN or biometric verification) and attestation of authenticators to provide a trust anchor for relying parties. It also supports resident keys and multiple credentials per user, enabling passwordless logins and phishing-resistant authentication. Attestation certificates help establish vendor identity when credentials are created, facilitating trust in new devices.

Context and impact: CTAP2 is part of the FIDO2 effort in collaboration with the W3C, aimed at enabling strong, phishing-resistant, passwordless authentication. It is implemented by many roaming security keys and by certain platform authenticators, and is broadly supported by modern browsers via the WebAuthn API.