U2F, OIDC mix widens authentication options

The Universal Second Factor (U2F) protocol from the FIDO Alliance is an interesting authentication story on its own, but even more so when coupled with another emerging standard called OpenID Connect. With the pair, you can solve more authentication challenges than either could on their own.

U2F provides a way for users to authenticate to sites using a hardware cryptographic device. It does this by using public key cryptography, but without the problematic infrastructure of legacy PKI systems. A new key pair is generated for every service that the user connects to, offering a secure and privacy-preserving authentication system. U2F support is included on all but one version of Yubico’s Yubikeys.

However, this isn’t quite the whole story. The U2F protocol on its own doesn’t actually identify any particular user, it merely proves  someone has the device with control over a registered key. The user’s identity is intentionally left out of the U2F process, and it must always be bound to some kind of user account for it to represent a person.

OpenID Connect (OIDC), on the other hand, is an identity federation protocol that is in use across the internet. Built on OAuth 2.0, OIDC lets users log into a website using an Identity Provider (IdP) service. This approach lets users leverage one account across a multitude of sites across the web and gives people control over which attributes of their identity are asserted and to whom in a secure and privacy-controlled fashion.

However, this isn’t quite the whole story either. The OIDC protocol doesn’t authenticate the user but rather conveys that authentication across the network. OIDC still requires that the user authenticate at the IdP, somehow. This could happen with a username and password, a certificate, a hardware token, or any number of other things.

So we’ve ostensibly got two authentication protocols, but authentication is a many-faceted thing. Each of these protocols addresses a slightly different take on authentication, intentionally leaving gaps to be filled by other technologies and components. The good news is we can combine U2F and OIDC to solve an even wider array of challenges than either can address alone.

For instance, an OIDC IdP could use a U2F device as part of its primary authentication mechanism for its users. This approach allows the user to strongly protect the primary identity they use all over the web. Alternatively, or even additionally, the OIDC and U2F protocols can be used in parallel. With this option, OIDC acts as a user’s primary login to a service, but a U2F device is registered on top of this federated login for additional protections that the service itself can check.

Want more details? We’ve put together a whitepaper that compares and contrasts U2F and OIDC, and gives more information on how they could be used together, both today and in the future. This whitepaper is freely available for download under a Creative Commons license.

Justin Richer is a guest blogger. He is a consultant at Bespoke Engineering, a disruptive technologist, and open source and standards advocate.

Talk to our teamTalk to our team

Share this article:


  • CEO Corner: Maintaining stable growth while navigating global uncertaintyAs we officially close out the first quarter of 2025,  I am pleased we saw a quarter with solid growth and profitability along with ongoing demand for phishing-resistant authentication. We continue to see new types of high-profile cyber attacks appearing regularly, and a major reason for the success of phishing attacks is stolen credentials. As […]Read moreCEOCEO CornerEarningsMattias Danielsson
  • Introducing the Yubico Academy: Enabling partners for a phishing-resistant futureAt Yubico, strong partnerships are fundamental to a more secure digital world. Our commitment goes beyond providing leading security keys; it’s about actively fostering the growth of our valued partners through impactful enablement programs. A cornerstone is the Yubico Academy, featuring our comprehensive certification program.  This program enables our partners’ teams to become Yubico experts, […]Read more
  • AI is booming — but proving you’re human matters more than everIf you walked the show floor at the RSA Conference this year, you probably noticed the same thing I did: Artificial Intelligence (AI) is everywhere. Agentic AI. AI in threat detection. AI in firewalls. AI in identity management. AI-generated demos. AI everything. The energy around AI was undeniable, and we’re seeing real innovation, efficiency gains […]Read moreAIArtificial IntelligencephishingRSAC
  • Ditching passwords for good: Celebrating the inaugural World Passkey DayHave you ever been stuck in a relationship with someone who constantly lets you down, exposes your secrets, and leaves you vulnerable? Odds are you cut your losses, packed up your things and moved on. Today is the day to do the same with your passwords: say goodbye forever! The reality is a majority of […]Read morepasskeyspasswordlessWorld Passkey Day