FIDO2 and WebAuthn

What FIDO2, WebAuthn, CTAP and U2F are

FIDO2 is the name for two linked standards. WebAuthn (Web Authentication) is the W3C browser API, which its abstract describes as an API for creating and using strong, attested, scoped, public key-based credentials. CTAP (Client to Authenticator Protocol) is the FIDO Alliance protocol a computer or phone uses to talk to the authenticator, such as a security key attached over USB, NFC or Bluetooth Low Energy. U2F is the older generation of the same family, now called CTAP1. CTAP2 can work with U2F devices, and WebAuthn has a section on backwards compatibility with U2F.

Registration creates a key pair on the authenticator, and the service keeps only the public key. At login the service sends a random challenge and the authenticator signs it. The credential is scoped to one relying party and the signed data includes the origin, so a response cannot be replayed against a different origin. That is why FIDO is called phishing-resistant: a fake site gets nothing it can reuse. Passkeys are built on the same standards.

How OpenSSH uses FIDO keys

OpenSSH 8.2 added FIDO/U2F support through two key types, ecdsa-sk and ed25519-sk (the suffix marks FIDO security-key types). The release notes explain that the private key file on disk holds only a key handle, and the real private key lives on the token and cannot be exported. The file should be useless to an attacker who does not have the physical token. SSH does not use the browser API: it signs its own authentication challenge with the same hardware.

Generate a key with the token attached, then confirm it works from a second terminal while your existing session stays open:

ssh-keygen -t ed25519-sk -O verify-required -C "admin-key-1"
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_sk myserver

The public half, id_ed25519_sk.pub, goes into authorized_keys like any other key (see ssh-copy-id). Hardware support for Ed25519 is less common than for ECDSA, and the release notes say every token must implement ecdsa-sk, so use -t ecdsa-sk if your token rejects the first command. See ssh-keygen for the other options.

Gotchas and security implications

A touch on the token is required by default, and the ssh-keygen manual says sshd refuses signatures from a key made with no-touch-required unless an authorized_keys option overrides that. Leave it alone. The option verify-required adds a PIN on each use, but not every authenticator supports it. On the server, the sshd_config manual says PubkeyAuthOptions verify-required has no effect on non-FIDO keys, so an ordinary key left in authorized_keys still logs in without any token.

Resident keys (-O resident) store the key handle on the token too, which is convenient across computers. The manual warns that this increases the likelihood of an attacker being able to use a stolen device, so set a PIN first. Both ends need a recent OpenSSH, and the client build must include the FIDO middleware (the manual names SecurityKeyProvider and SSH_SK_PROVIDER for choosing a library). Tokens get lost, so enrol a second one before you rely on the first.

Where it fits in server hardening

A key file can be copied silently from a laptop or a backup, and a FIDO key removes that weakness: stealing the file is not enough. CISA writes that "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication", and calls phishing-resistant MFA the standard to strive for (its MFA page is now marked as archived content). For a small server this means hardware keys for administrators first, and for the hosting account and mailbox that can reset everything else.

The SSH two-factor authentication guide shows the full rollout, including the sshd setting and the order that keeps you from being locked out, and the SSH hardening guide covers the baseline you should have first. If a token is lost or an edit goes wrong, the locked-out recovery guide explains how to get back in. FIDO is one way to meet two-factor authentication; the one-time-code option is TOTP.

Related terms: Two-factor authentication (2FA), TOTP, ssh-keygen, Key-based authentication, authorized_keys.