Few open questions around FIDO2 webauthn and U2F

Question

• I've read in multiple places that since U2F doesn’t have a concept of a user it can be used as one of the factors for login (in MFA) but not ideal for passwordless whereas webauthn has the concept of users which could help with passwordless. My question is what is that extra that webauthn adds to allow this? Yes, we do pass user information when we create the credentials but in the end we're returned a credential id (which seems to be very similar to the keyhandle) and is used to associate the user (on the server). For what i understand, webauthn def has the advantage of working with different authenticators (not just U2F keys) but apart from that what exactly does webauthn add to make passwordless easier.

• CTAP describes how the browser and operating system establish communications with a compliant authentication device over USB, NFC or BLE communication mediums. Could we say CTAP is an application layer protocol (like FTP?)

• When i use the finger print feature on my android phone to verify using webauthn, is the browser communicating with the OS (which in turn pops up the authenticator) using CTAP2? Where does ufc, nfc, ble, internal come up here?

• Here is a diagram for browser support for webauthn. In chrome/android, what does it mean to have stable support for WebAuthnAPI but In development support for CTAP2? Does it mean some authenticators wont be supported?

Answer 1

The spec specifically refers to it as an application layer protocol in the abstract:

https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html

The implementation from browser to browser and OS to OS will differ. Windows 10 now offers a native API which sits over the top of Windows Hello and standardises interactions with authenticator devices. Prior to this browsers on Windows had their own implementations and their own UIs. A given CTAP2 implementation would include support for 1 or more of the transports defined in the spec, each having a binding specific to the needs of that transport. The spec is worth a read.

Lack of CTAP2 support in the examples given above would mean that while you could use a backwards compatible FIDO2/CTAP2 compliant device you'd miss out on the added features of FIDO2 - primarily resident keys and thus the ability to have passwordless logins.

ETA: This artical is pretty good and has some nice diagrams: https://hybrismart.com/2019/05/23/authentication-with-hardware-security-keys-via-webauthn-in-sap-commerce-cloud/