CTAP 2.1: FIDO's new tricks for passkeys on security keys
summary
CTAP 2.1 (published summer 2022) adds concrete controls to physical security keys: Enterprise attestation reveals a key serial number only at registration (manufacturer-burned or platform-managed) for asset tracking not extra crypto trust; PIN change on first use and minimum PIN length enforce reset and ratcheting (cannot lower without reset); storage: large blob (1–4 KB shared) and per-credential blobs (32–128 bytes); always require user verification forces PIN/biometric each use; credential management lets listing/deleting keys but on Windows requires admin, on macOS Chrome supports it.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:08What is CTAP 2.1
- 2:53New features in CTAP 2.1
- 4:00Enterprise authentication
- 5:10PIN-related features
- 8:04Storage features
- 10:29User verification requirements
- 12:43Q&A on new features
- 19:13Previously existing features
- 21:29Summary and testing
- 22:10Q&A on Enterprise attestation
- 23:19Q&A on credential management
- 25:06Closing remarks
related talks
17mFIDO CTAP 2.1
02h 22mFIDO 101
05m“You still use the password after all” – Exploring FIDO2 Security Keys in a Small
29mWhat the Authn? Passkeys Offer a Fresh Take to Authentication Dilemmas
26mHey FIDO Meet Passkey
01h 00mFeatured Keynote
22mPasskeys through FIDO: How to write your own client?
52mPasskeys: The Good, the Bad and the Ugly