Passwords are easily guessed and easily stolen, making them the leading cause of security breaches. This is common knowledge at this point. We also know that passwordless authentication seeks to remedy this problem by enabling users to access an application or IT system without using a password.

What you might not know is that by moving to passwordless authentication, your users can enjoy a better log-in experience and stronger security. There’s one hurdle, however. The specifications for passwordless authentication are continually evolving, making it difficult for organizations and their security practitioners to keep up with changing protocols, standards, and methods. We want to make that process easier for you. Let’s look at the differences between FIDO2 and U2F so you can choose and implement the protocol that works for you.

FIDO2: the gold standard in passwordless authentication

What is FIDO2?

FIDO2 is the overarching term for FIDO Alliance’s latest set of strong authentication standards. These standards were developed based on public key cryptography to enable phishing-resistant authentication that is simpler for consumers to use and easier for developers to deploy and manage. FIDO2 allows users to authenticate to online services in both mobile and desktop environments with local device biometrics and roaming authenticators.

FIDO2 does this with two specifications: W3C’s Web Authentication (WebAuthn) and FIDO Alliance’s Client to Authenticator Protocol (CTAP).

A simple way to think of it is FIDO2 = WebAuthn + CTAP2

WebAuthn is a standard web API that enables users to sign in with a cryptographic key pair. The specification enables passwordless FIDO authentication on the web.

CTAP (or CTAP2) builds on Universal 2nd Factor (U2F) specifications (renamed CTAP1) to enable communication between an external authenticator (e.g., mobile phones or USB-based devices such as security keys, NFC, and Bluetooth-enabled devices) and browsers and operating systems. CTAP2 enables single-, two-factor, and multi-factor passwordless authentication options for users.

How it works

1. During registration, the user’s client device creates a key pair—keeping the private key on the device and registering the public key with the online service.
2. The client device authenticates the user by proving possession of the private key to the service by signing a challenge (such as scanning a finger, entering a PIN, or pressing a button).
3. When the user goes to log in after registration, the user unlocks the FIDO authenticator following the same method as when they registered.
4. The device selects the correct key and signs the service’s challenge based on the user’s account identifier.
5. The service verifies the signed challenge with the stored public key and signs in the user.

U2F: passwordless as second factor

With the release of FIDO2, U2F was relabeled as CTAP1. This means that U2F has been merged into FIDO2. So what does this mean, exactly? Let’s break it down.

What is U2F?

FIDO U2F allows a strong second factor for user login. For instance, the user logs in with a username and password as before. But the service can also prompt the user to present a FIDO security key at any time it chooses as a second factor. This strong second factor allows the service to simplify its passwords (e.g., 4–digit PIN) without compromising security.

During registration and authentication, the user presents the second factor by simply pressing a button on a USB device or tapping over Near-Field Communication (NFC) or Bluetooth (BLE). The user can use their FIDO U2F device across all online services that support the protocol by leveraging built-in support in web browsers.

If U2F is merged into FIDO2, is it no longer in use? Is it dead?

Not at all. While it’s true that FIDO U2F capabilities have merged into CTAP1, FIDO U2F security keys will continue to work with services that support U2F authentication as well as those that support FIDO2 authentication.

CTAP1 vs. CTAP 2

Under FIDO2, CTAP1 is the new name for FIDO U2F. CTAP1 allows the use of existing FIDO U2F devices (such as FIDO Security Keys) for authentication on FIDO2-enabled browsers and operating systems over USB, NFC, or BLE for a second-factor experience.

With the release of FIDO2, CTAP2 became the new standard specification in conjunction with WebAuthn. It defines communication between FIDO2-enabled browsers and operating systems, and external authenticators for a passwordless, multi-factor authentication. An authenticator using CTAP2 is called a WebAuthn Authenticator or FIDO2 Authenticator. If a FIDO2 authenticator also implements CTAP1, it is backward compatible with U2F.

No More Passwords, No More Problems

Okay, maybe it won’t solve all your problems. But passwordless authentication is the future of modern, phishing-resistant authentication. FIDO2 delivers stronger security, greater convenience, more privacy, and increased scalability for users and organizations.

But deploying FIDO2 authentication can be resource-intensive. You need to understand platform differences in WebAuthn support and be able to build and maintain a FIDO2 server. Plus, the cybersecurity landscape is always evolving—and authentication standards and protocols will change with it.

Want the security but not the struggle? You can enjoy the benefits of FIDO authentication without building it from scratch with Beyond Identity. Beyond Identity is the technology innovator in FIDO2-certified multi-factor authentication, delivering a passwordless, phishing-resistant, and effortless user experience that prevents credential breaches and delights users.

Get started today.