FIDO — the technology stack, down to the secure element.
This is the FIDO technology reference. For the product-integration view — designing FIDO into consumer electronics — see integrating the FIDO protocol into consumer electronics on Ambimat.
FIDO replaces shared-secret passwords with public-key cryptography bound to the relying party origin. The credential lives on the authenticator (smart card, USB key, platform TPM); the server never sees a secret. We ship hardware authenticators, write FIDO applets, and run the validation server backend.
Two specs working together
- WebAuthn — the W3C JavaScript API the browser exposes to your relying-party page (
navigator.credentials.create()and.get()). - CTAP2 — the Client-To-Authenticator Protocol the browser uses to talk to the actual hardware over USB-HID, NFC, or BLE.
On the server side you implement a relying party that issues challenges and verifies signatures — for example our FIDO Validation Server. The browser API, ceremonies and data structures are covered in depth on the WebAuthn technology page; the wire protocol and PIN/UV handshake on the CTAP2 page.
The trust chain in five layers
Resident vs non-resident credentials
A non-resident credential is encoded in the credentialId and lives only on the server. A resident (discoverable) credential lives on the authenticator and enables the smoothest UX: username-less, passwordless — you tap or insert and you are in. The OnePass Card stores up to 25 resident credentials.
Inside a hardware FIDO authenticator
A roaming hardware authenticator is a secure element running a FIDO applet. On AmbiSecure OnePass devices the stack is:
- Chip — a Common Criteria EAL6+ secure element. Private keys are generated inside it and never exported.
- Card operating system — JavaCard 3.x with GlobalPlatform 2.3.1, which isolates applets and controls how they are loaded.
- FIDO applet — implements the CTAP2 and U2F (CTAP1) commands. Optional PIV or OpenPGP applets can sit alongside it on the same chip. Applets are loaded over SCP03.
- Personalisation — per-card issuer keys are derived, and the AAGUID and attestation certificate are written at issuance.
Credential storage follows from that design. A discoverable credential occupies a slot in the chip (OnePass devices hold up to 25, depending on chip variant). A non-discoverable credential costs no storage, because it is carried in the credentialId.
Roaming vs platform. A roaming authenticator (card, USB key) moves between devices over USB, NFC or BLE. A platform authenticator is built into one device, using its TPM or secure enclave. The trade-offs are covered in Platform vs Roaming Authenticators.
Attestation and AAGUIDs
An authenticator can prove what it is via an attestation statement — signed by the manufacturer’s root key. Each model has an AAGUID recorded in the FIDO Metadata Service. Consumer apps usually skip attestation (attestationType: 'none'); enterprise apps that require certified hardware verify the attestation against MDS and enforce AAGUID allow-lists.
Pillar reading
Implementing FIDO2: A Complete Developer Guide
End-to-end walkthrough — registration, authentication, pitfalls.
Read → HardwareEmbedded Secure-Element FIDO2 Authenticators
FIDO2 on nano-card and solderable secure elements.
Read → SolutionReplacing password + OTP
The authentication problem FIDO solves, and how to migrate.
Read →