UAF - Universal Authentication Framework
Clone or download
npesic Merge pull request #37 from nelenkov/fp-authenticator
removed username from header comment
Latest commit 416c469 Oct 3, 2017
Failed to load latest commit information.
fido-uaf-core Clean up (TAG_KEYID is checked twice) Oct 31, 2016
fidouafclient removed header comment Oct 3, 2017
.gitignore updated .gitignore Sep 27, 2017
.travis.yml Update .travis.yml May 6, 2016
LICENSE Update LICENSE Sep 10, 2015 Update Oct 2, 2017 Added endpoints for whitelisting AAID, and Facet Ids Oct 15, 2016
build.gradle add gradle build script Dec 21, 2015
settings.gradle add gradle build script Dec 21, 2015

Build Status Gitter

UAF - Universal Authentication Framework

UAF Architectural Overview

News & Release Notes


The main goal is the passwordless authentication experience


  • Simple to authenticate using biometrics readings, such as fingerprint
  • More secure authentication using the cryptography


  • Standardize the messages, and the message exchange sequence
  • Standardize the way how biometric authenticators are receiving requests and giving out responses
  • Define how cryptography can be used to secure messages that are exchanged


  • Identifying all required data that needs to be part of the protocol messages
  • Correct implementation of message exchange sequence
  • Correct implementation of cryptography sign/verify operations
  • Correct implementation of encoding/decoding of the messages


  • Number of successful application of the protocol is high
  • Number of protocol adaptations in comparing with password authentication is higher
  • Number of security bugs equal to zero

Implementation details

The code presented here is divided into three groups:

  1. fido-uaf-core - UAF protocol implementation
  2. fidouaf - UAF server, a Jersey service application for demoing UAF protocol implementation use
  3. RP Client App - Android relying party client app for demoing UAF server

Steps for running the demo

  1. Build and run the UAF server as described in the Wiki page of the project (
  2. Build and run the client (fidouafclient).
  3. Obtain the facetID of the client.

3.1. If the client program is run on an android device, pressing the button labelled "facetID" will display the string representing the facetID of the client program on the screen.

3.2. If the client program is run on an emulator, pressing the button labelled "facetID" will cause the string representing the facetID of the client program to be printed on the IDE console (Logcat). The string can be located by searching for the term "facetID:".

  1. In the file UAF/fidouaf/src/main/java/org/ebayopensource/fidouaf/res/, replace the example string representing the facetID of the client program with the value obtained in step 3.
  2. Set the Server Endpoint on the client by clicking on the settings menu on the upper right corner of the client application, filling in an appropriate IP address and port for the server (e.g.,, then clicking on the checkmark to save the settings.
  3. The client and the server are now ready to be tested.