Client To Authenticator Protocol (CTAP)

Credential management is used to manage discoverable credentials on the authenticator. This feature is important, as without it there is no way to delete credentials that are stored on an authenticator, other than resetting the authenticator (and deleting all credentials instead of a specific one). Hardware security keys typically have limited storage for discoverable credentials (for instance 100 on a YubiKey with firmware 5.7), so it can be very useful to delete credentials that are no longer being used.

Credential Management also allows for enumeration of credentials, the retrieval of credential metadata and updating credential user information.

The YubiKey and the FIDO Security Key by Yubico support credential management since firmware version 5.2.

The fido2-token tool can be used for performing credential management from the command-line.

For instance, to list discoverable credentials stored on a device:

To delete a discoverable credential, use the -D option and specify its (base64-encoded) credential ID with -i:

Enterprise Attestation (EA) was added in CTAP version 2.1 and WebAuthn L2. As suggested by its name, it is intended for use within enterprises to uniquely identify an authenticator, something that is explicitly made infeasible with normal attestation to preserve user privacy. In an enterprise scenario, EA can be used for asset tracking or to aid in account recovery flows by allowing an end user to prove they have a specific FIDO2 authenticator. It requires an authenticator that is specifically configured for use within a particular enterprise, so it will not be generally available on authenticators.

See also our guidance on using Enterprise Attestation in web applications.

The YubiKey and the FIDO Security Key by Yubico support enterprise attestation since firmware version 5.7, but only on custom configured keys. It will allow Relying Parties to read the serial number (or another organization-specified unique identifier) from the YubiKey during FIDO2 registration.

Enterprise attestation can be enabled on a device using:

This feature, called AlwaysUV, causes every FIDO2 registration or authentication event to require a PIN or biometric, regardless of the options set by the relying party or platform.

The current status for AlwaysUV can be retrieved using When using the fido2-token tool with the -I switch, the current status is listed under options as

The AlwaysUV feature can be enabled on a device using fido2-token -S -u or disabled using fido2-token -D -u.

Another feature that is intended for use in an enterprise or government environment is "Set Minimum PIN Length", which enforces a minimum PIN length policy for authenticators.

Minimum PIN Length allows Identity Providers to enforce the configured minimum PIN length during FIDO2 registration, to support self-enrollment processes. The minimum PIN length can only be configured by platforms, or by communicating to the YubiKey directly, and can only be enforced by identity providers or relying parties in an allowed list configured on the YubiKey.

To set a minimum PIN length for a device to 6:

To force a PIN change:

The authenticator cannot be used before the PIN is changed. For instance, when listing discoverable credentials, an PIN violation occurs:

To set a list of RP IDs allowed to retrieve the minimum PIN length, use the -S -m option:

See also the minimum PIN length extension below.

The Credential Protection extension can be used to improve privacy in case an unauthorized user has access to an authenticator. It allows a Relying Party to set a credential protection policy at registration.

With the Credential Protection extension set, the associated FIDO2 credential can be flagged to not be exposed to any one without user verification It can neither be read nor used for authentication with the user asserting their identity.

The Large blob storage extension (largeBlob) allow a Relying Party to

Note that large blobs are also available from the WebAuthn API. See the WebAuthn Level 2 W3C Recommandation.

Note that on some browsers, the HMAC Secret extension is also available

To list all large blobs stored on an authenticator:

To store the contents of file myfile as a large blob on an authenticator:

To retrieve a large blob from an authenticator and store it in myfile:

To delete a large blob associated with RP ID example.org from an authenticator:

An example use-case for largeBlobs is SSH, where an SSH certificate can be stored on an authenticator, together with is corresponding private key.

See Storing SSH Certificates on a FIDO security key.

The Minimum PIN Length extension allows clients to retrieve the minimum PIN length for a specific RP ID. Which RP IDs are allowed to retrieve this information can be set.

The HMAC Secret extension can be used by a client to retrieve a symmetric secret from the authenticator when it needs to encrypt or decrypt data.

The HMAC secrets extension is enabled on a create credential request, and the symmetric secret is scoped to the generated credential.

For an example of using the HMAC Secret extension using the python-fido2 Python library, see hmac_secret.py.

Note that on some browsers, the HMAC Secret extension is also available from the WebAuthn API, where it is known as the PRF extension. The WebAuthn PRF extension is specified in the forthcoming WebAuthn Level 3 draft.