The FIDO Stack

The FIDO Stack explains how modern FIDO authentication actually works, from the WebAuthn API in the browser to CTAP communication with the authenticator. It builds the architecture from first principles and follows registration and authentication end to end, showing what each component knows, what data crosses each boundary, what gets signed, and why the resulting credentials are resistant to phishing.The book covers credential creation and discovery, relying-party and origin binding, user presence and user verification, PIN/UV authorization, passkeys and credential synchronization, attestation, extensions, CBOR and COSE, CTAP commands, authenticator data, and transports such as CTAPHID. It also examines the security boundaries of the system: what FIDO protects, what it does not, and which assumptions remain outside the protocol.Rather than reproducing the specifications, The FIDO Stack connects WebAuthn and CTAP into a single understandable system, using diagrams, protocol flows, byte-level details, and implementation-oriented explanations where they matter.Written for developers, security engineers, researchers, and anyone who wants to understand what happens beneath a WebAuthn or passkey login, the book provides a practical mental model of the complete FIDO stack-from the relying party to the authenticator and down to the bytes on the wire.