deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-17 15:57:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

First draft Microsoft compatible security keys

Browse Source
This commit is contained in:
Aabha Thipsay 2018-10-25 15:30:11 -07:00
parent cf9de3c509
commit 91ad3f0f1f
2 changed files with 27 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
windows/security/identity-protection/hello-for-business/FIDOTest.md
View File

@ -1,15 +0,0 @@
---
title: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments
description: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security, mobile
author: mikestephens-MS
ms.author: mstephen
ms.localizationpriority: medium
ms.date: 08/20/2018
---
# Test Page for FIDO
I was there hello

27
windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md Normal file
View File

@ -0,0 +1,27 @@
---
title: Microsoft compatible security key
description: Windows 10 enables users to sign in to their device using a security key. How is a microsoft compatible security key different (and better) than any other FIDO2 security key
keywords: FIDO2, security key, CTAP, Hello, WHFB
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security, mobile
author: aabhathipsay-MS
ms.author: aathipsa
ms.localizationpriority: medium
ms.date: 10/25/2018
---
# What is a Microsoft compatible security key?
Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) from the start with a mission to replace passwords with an easy to use, strong credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users.
The FIDO2 CTAP specification contains a few optional features and extensions which are crucial to provide that seamless and secure experience.
A security key **must** implement the following features and extensions from the FIDO2 CTAP protocol to be Microsoft compatible:
| #</br> | Feature / Extension trust</br> | Why is this required? </br> | Relevant Section in FIDO2 CTAP specification</br>|
| --- | --- | --- | --- |
| 1 | Resident key | This feature enables the security key to be portable, where your credential is stored on the security key | Section XXX |
| 2 | Client pin | This feature enables security keys to protect your credentials with a second factor like PIN </br> We recommend strong multi-factor credentials for authentication to all Microsoft services| Section XXX |
| 3 | hmac-secret | This extension ensures you can sign-in to your device when it’s off-line or in airplane mode | Section XXX |
| 4 | Multiple accounts per RP | This feature ensures you can use the same security key across multiple services like MSA and AAD | Section XXX |