FIDO2 / WebAuthn

WebAuthn credentials are scoped to the specific domain (e.g., agent.inferensys.com) that created them. The browser or platform authenticator automatically enforces this binding. A credential created for agent.inferensys.com will never be released to a phishing site at agent.inferensys-secure.com. This eliminates the human decision point that phishers exploit.

• Key Mechanism: The relying party ID (RP ID) is cryptographically included in the assertion.
• Result: Man-in-the-middle interception fails because the TLS channel and the credential origin must match.

Unlike passwords or OTPs, FIDO2 uses asymmetric key pairs. During registration, the authenticator generates a unique private key that never leaves the device. The server stores only the corresponding public key. During authentication, the server sends a challenge, the authenticator signs it with the private key, and the server verifies the signature.

• No Shared Secrets: Server-side database breaches yield only useless public keys.
• Unlinkable: Different key pairs are generated for each service, preventing cross-service tracking.

FIDO2 supports multiple levels of user verification, allowing agents and services to enforce step-up authentication policies. User Presence (UP) requires a simple touch or interaction. User Verification (UV) requires a local gesture like a biometric scan or PIN entry before the private key is unlocked.

• UP: Confirms a human is physically present.
• UV: Confirms the specific authorized human.
• Agent Context: Autonomous agents can use platform keys with UV to prove they are executing on an authorized, attested device.

Resident keys store the credential ID and user handle directly on the authenticator, enabling usernameless authentication. The user simply selects the account from a list on their security key or platform authenticator. For agentic systems, this allows a single hardware-bound identity to be presented without transmitting a username first.

• Usernameless Flow: The server sends an empty allowCredentials list.
• Hardware Limits: Security keys have limited storage slots for resident keys.
• Enterprise Use: Ideal for passwordless workstation login and agent identity assertion.

Attestation provides cryptographic proof of the authenticator's make and model during registration. This allows a relying party to enforce hardware security policies, such as requiring a FIPS-certified security key. The attestation statement is signed by the manufacturer's root certificate.

• None Attestation: Maximum privacy, no hardware data revealed.
• Direct Attestation: Full hardware identification for high-assurance environments.
• Enterprise Attestation: Allows corporate-managed authenticators to be uniquely identified.

The Client to Authenticator Protocol (CTAP2) defines how external authenticators (like USB security keys) communicate with the browser. Platform authenticators (like Touch ID or Windows Hello) are built directly into the device. FIDO2 unifies both under the WebAuthn API.

• CTAP2: Enables roaming authenticators over USB, NFC, and BLE.
• Platform Keys: TPM-backed keys that never leave the device silicon.
• Hybrid Transport: Newer specs allow cross-device authentication via QR codes and BLE.