{"id":2631,"date":"2025-03-18T00:15:34","date_gmt":"2025-03-18T07:15:34","guid":{"rendered":"https:\/\/self-issued.info\/?p=2631"},"modified":"2026-04-15T08:35:28","modified_gmt":"2026-04-15T15:35:28","slug":"third-version-of-fido2-client-to-authenticator-protocol-ctap-2-2-now-a-standard","status":"publish","type":"post","link":"https:\/\/self-issued.info\/?p=2631","title":{"rendered":"Third Version of FIDO2 Client to Authenticator Protocol (CTAP 2.2) Now a Standard"},"content":{"rendered":"<p><span class=\"plain\"><a href=\"https:\/\/fidoalliance.org\/\"><img loading=\"lazy\" decoding=\"async\" width=\"136\" height=\"100\" align=\"right\" alt=\"FIDO logo\" src=\"https:\/\/self-issued.info\/images\/fido_logo.png\"><\/a><\/span>The FIDO Alliance has completed the <a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html\">CTAP 2.2 Specification<\/a>.  The closely-related third version of the W3C Web Authentication (WebAuthn) specification is also nearing final status; this <a href=\"https:\/\/www.w3.org\/TR\/2025\/WD-webauthn-3-20250127\/\">WebAuthn Level 3 working draft<\/a> is currently going through the review steps to become a W3C Recommendation.<\/p>\n<p>So what&#8217;s new in the third versions?<\/p>\n<p>Changes between <a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.1-ps-20210615\/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html\">CTAP 2.1<\/a> and <a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html\">CTAP 2.2<\/a> are:<\/p>\n<ul>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#makecred-attestationformatspreference\">Creation option with a prioritized list of supported attestation formats (attestationFormatsPreference)<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#authnrClientPin-globalState-persistent-puat\">PersistentPinUvAuthToken State<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-feature-descriptions-pinComplexityPolicy\">Set PIN Complexity Policy<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-feature-descriptions-jsonBasedMessages\">JSON-based Messages<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-hybrid\">Hybrid Transports<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-largeBlob-extension\">Large Blob Extension (largeBlob)<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-pincomplexitypolicy-extension\">PIN Complexity Extension (pinComplexityPolicy)<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-hmac-secret-make-cred-extension\">HMAC Secret MakeCredential Extension (hmac-secret-mc)<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/specs\/fido-v2.2-ps-20250714\/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-thirdPartyPayment-extension\">Third-Party Payment Authentication Extension (thirdPartyPayment)<\/a><\/li>\n<\/ul>\n<p>Changes between <a href=\"https:\/\/www.w3.org\/TR\/2021\/REC-webauthn-2-20210408\/\">WebAuthn Level 2<\/a> and the <a href=\"https:\/\/www.w3.org\/TR\/2025\/WD-webauthn-3-20250127\/\">WebAuthn Level 3 working draft<\/a> are described in the document&#8217;s <a href=\"https:\/\/www.w3.org\/TR\/2025\/WD-webauthn-3-20250127\/#changes-since-l2\">Revision History<\/a>.<\/p>\n<p>Completing these V3 specifications represents important progress in our quest to free us from the password!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The FIDO Alliance has completed the CTAP 2.2 Specification. The closely-related third version of the W3C Web Authentication (WebAuthn) specification is also nearing final status; this WebAuthn Level 3 working draft is currently going through the review steps to become a W3C Recommendation. So what&#8217;s new in the third versions? Changes between CTAP 2.1 and [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,34,19,21,25,33],"tags":[],"class_list":["post-2631","post","type-post","status-publish","format-standard","hentry","category-cryptography","category-fido","category-phishing-resistance","category-privacy","category-specifications","category-w3c"],"_links":{"self":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2631"}],"version-history":[{"count":6,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2631\/revisions"}],"predecessor-version":[{"id":2828,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2631\/revisions\/2828"}],"wp:attachment":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}