FIDO2, CTAP 2.1, and WebAuthn 2: Provable Security and Post-Quantum Instantiation

ePrint Report: FIDO2, CTAP 2.1, and WebAuthn 2: Provable Security and Post-Quantum Instantiation

Nina Bindel, Cas Cremers, Mang Zhao

The FIDO2 protocol is a globally used standard for passwordless authentication, building on an alliance between major players in the online authentication space. While already widely deployed, the standard is still under active development. Since version 2.1 of its CTAP sub-protocol, FIDO2 can potentially be instantiated with post-quantum secure primitives.
We provide the first formal security analysis of FIDO2 with the …

eprint report fido2 post-quantum provable security quantum security webauthn