Similar to legacy U2F, Web Authentication is resilient to verifier impersonation, that is, it is resistant to phishing attacks, but unlike U2F, WebAuthn does not require a traditional password. A roaming hardware authenticator conforms to the FIDO Client to Authenticator Protocol (CTAP), making WebAuthn effectively backward compatible with the FIDO Universal 2nd Factor (U2F) standard. Sensitive cryptographic operations can also be offloaded to a roaming hardware authenticator that can in turn be accessed via USB, Bluetooth Low Energy, or near-field communications (NFC). This makes it possible to implement support for WebAuthn purely in software, making use of a processor's trusted execution environment or a Trusted Platform Module (TPM). The underlying cryptographic operations are performed by an authenticator, which is an abstract functional model that is mostly agnostic with respect to how the key material is managed. On the client side, support for WebAuthn can be implemented in a variety of ways.

The goal of the project is to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. Web Authentication ( WebAuthn) is a web standard published by the World Wide Web Consortium (W3C).

Fido2 yubikey