CTAP 2.3 is a newer version of the FIDO Client to Authenticator Protocol, the message format used by browsers, operating systems, and apps to talk to hardware authenticators such as security keys and passkeys. It defines how a client asks a device to register, authenticate, or perform newer approval-style ceremonies, while the device enforces user presence and keeps private keys inside the authenticator.
In cyber security, CTAP matters because the protocol boundary is where trust is made concrete. Strong defenses depend on the client and relying party checking the right ceremony, origin, and transaction context, not just accepting any signed response from a key. That reduces phishing and helps prevent confused-deputy problems, where an approval meant for one action is reused for another. In attacks, weak CTAP handling can let malicious software, a spoofed interface, or a poorly designed app turn a physical tap into approval for something the user did not intend. In defenses, CTAP 2.3 supports more precise, hardware-rooted authorization workflows.