8

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration.

Deployment:

Question

How different is the W3C FIDO 2.0 Web API's from the current enrollment for Relying Parties as described here and in this script?

makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • http://security.stackexchange.com/questions/71590/what-are-the-differences-between-the-u2f-and-uaf-fido-authentication-standards – Kamic Feb 22 '17 at 13:10
  • 1
    Thanks for the link; I'm looking for a * flow * difference (swimlanes) between the entities, and the payload differences. That linked question actually has a comment saying "I was hoping for more details" – makerofthings7 Feb 23 '17 at 01:22
  • 1
    Agreed, I wish you the best on your bounty! =) upvoted – Kamic Feb 23 '17 at 02:11
  • See below, I tried to give the best answer... Reminder: Don't rely on any old Microsoft implementation, the original one was an insider private joke. The real Web Authentication is currently being specified and developed, there are no real "certified" implementation for now. I am involved into a few FIDO U2F (and derivated) projects... Welcome to the jungle! :) – FredericMARTIN Feb 28 '17 at 09:40

1 Answers1

5

Great question :) A quick note to explain the long silence about that: Nobody was really able to answer this question until recently because there were many debates about possible links between FIDO "1.0" and "2.0" (mainly because there were no real details about FIDO 2.0 for a long time...).

First, your question details are kind of outdated (that's normal). Inside FIDO Alliance technical discussions, FIDO 2.0 is not really used anymore and the link about the real updated w3c submission group is done with a new name: "Web Authentication" or "WebAuthN", and you can follow news here : https://www.w3.org/blog/webauthn/

You can forget every article about first old "FIDO 2" Microsoft implementations, this was purely experimental (* cough * marketing BS * cough *) and done even before the first specifications draft was available. Now Microsoft is really part of the ongoing "WebAuthN" work so MS documentation is currently being updated from time to time... but there are simply no real existing implementations for now as specifications have still to be be finalized. It will be done "soon" (later this year).

Now the real - still partial - answer you can get to this date (2017-02-23)...

The very recent 4th public Working Draft of "WebAuthN" (ex-FIDO2) is available here : https://www.w3.org/TR/2017/WD-webauthn-20170216/ and you can see this is the same as the last official release (https://www.w3.org/TR/webauthn). You'll be able to find info there about new credential registration and authentication assertion verification... and for the first time, you'll find a new section "FIDO U2F Attestation Statement Format" that is the first step of finding a missing link between FIDO U2F and WebAuthN (ex-FIDO2).

(I don't think there is or will be any kind of compatibility between UAF and WebAuthN but let's consider WebAuthN as the new non-messy UAF)

I hope it helped :)

FredericMARTIN
  • 581
  • 3
  • 8