WebAuthnFIDO2ramverket

WebAuthnFIDO2ramverket is a security standard that combines the WebAuthn API and the FIDO2 protocol to enable passwordless and phishing-resistant authentication on the web. It relies on public key cryptography, where the relying party stores a unique public key for each user and the user’s authenticator holds the corresponding private key. The framework supports both platform authenticators (built into devices) and roaming authenticators (external hardware or security keys).

Registration creates a new credential: the authenticator generates a key pair, the public key is sent to the server and the server associates it with the user. Authentication proves possession of the private key by producing a signature over a challenge, which the server verifies with the public key. Attestation may be provided to reveal the type of authenticator, aiding deployment and auditing but raising privacy considerations.

WebAuthn is implemented in browsers via the WebAuthn API, while CTAP (Client To Authenticator Protocol) governs communication with authenticators. CTAP2 is the modern transport for roaming devices, and CTAP1/U2F compatibility remains in some ecosystems. The server side validates assertions, optionally enforces user verification, and manages credential lifecycles.

Adoption covers major browsers and operating systems, with platform authenticators such as Windows Hello, macOS/iOS passkeys, Android, and roaming authenticators including USB, NFC, or Bluetooth devices. The framework is commonly used as a primary login method or as a strong second factor in multi-factor authentication. Privacy and security considerations include minimizing attestation leakage, user consent, and credential recovery strategies.