Authenticator Level 2
Authenticator Certification Level 2 (L2) evaluates FIDO Authenticator protection against basic, scalable attacks.
For L2, the Authenticator is required to conform to a solution included in FIDO Allowed Restricted Operating Environment and Allowed Cryptography lists as part of the Authenticator Security Requirements.
- Pure Rich OS software implementations of Authenticators that do not have a restricted operating environment.
- Authenticators that do not support attestation.
If either of these examples applies to your implementation, please visit Authenticator Level 1.
Next Steps
Depending on your current implementation and the Level you wish to complete the process varies slightly. The scenarios below will help determine the next steps:
Client or Server Implementation
Certification levels are only for Authenticators, Clients and Servers can complete Functional Certification.
New Authenticator Implementation
If you are completing FIDO Certification for the first time for this implementation, the first step for certification is to start at Functional Certification.
Functional Certification tests conformance to the specifications and Interoperability with FIDO Clients and Servers.
No Security Requirements are tested during Interoperbility Testing for L2, but the Functional Certification steps are still required.
After Functional Certification, the implementation continues on to the process outlined in the Authenticator Certification Policy, and on the Authenticator Certification Levels page.
It is required that the Level 2 Vendor Questionnaire be evaluated by a FIDO Accredited Security Laboratory as part of the Security Evaluation step of Authenticator Certification. The Vendor is responsible for choosing and working with one of the FIDO Accredited Security Laboratories to complete the Security Evaluation.
All L2 implementers must create an account for FIDO Certification, you can request an account, or login.
Functionally Certified Authenticator Implementation
For a Functionally Certified Authenticator seeking L2 Certification, the Functional Certification requirements were met by the original Functional Certification (there are no new Interoperability Requirements for L2), so the next step is to follow the process included in the Authenticator Certification Policy, and on the Authenticator Certification Levels page, to complete the Vendor Questionnaire.
It is required that the Level 2 Vendor Questionnaire be evaluated by a FIDO Accredited Security Laboratory as part of the Security Evaluation step of Authenticator Certification. The Vendor is responsible for choosing and working with one of the FIDO Accredited Security Laboratories to complete the Security Evaluation.
All L2 implementers must create an account for FIDO Certification, you can request an account, or login.
L2 Certification Fees
Fees are per implementation certified and must be paid before a Certificate will be issued.
For an overview of the different Certification options and fees, please review the Authenticator Certification Scenarios page.
Functional Certification Fees
- FIDO Member: $5,000 USD
- Non-Member: $6,500 USD
L2 Certification Fees
- FIDO Member: $7,500 USD
- FIDO Member Derivative: $500 USD
- FIDO Member Delta: $500 USD
- Non-Member: $13,000 USD
- Non-Member Derivative: $750 USD
- Non-Member Delta: $750 USD
Laboratory Security Evaluation Fees
- There is no FIDO Fee for a Laboratory Evaluation. The cost for the Security Evaluation will depend on the Accredited Security Laboratory used by the Vendor.
Implementer Dashboard
Implementers can Login to view their Dashboard.
