WebAuthn: Difference between revisions

Line 3:

WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters.

WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an "authenticator", which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This, in general, is more secure, as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn effectively backward compatible with the [[Universal 2nd Factor]] (U2F) standard.

WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an [[authenticator]], which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This, in general, is more secure, as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn effectively backward compatible with the [[Universal 2nd Factor]] (U2F) standard.

WebAuthn as well as CTAP are both outgrowths of the FIDO2 project<ref name="fido2"/>, which tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.

WebAuthn as well as CTAP are both outgrowths of the [[FIDO2]] project<ref name="fido2"/>, which tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.

== Application and device support ==

The WebAuthn Level 1 standard was published as a Proposed Recommendation by the [[Web Authentication Working Group]] on January 17, 2019.<ref name="webauthn"/> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/>

Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> ~~The~~ first ~~new token able~~ to ~~handle~~ the ~~new "~~FIDO2~~" style of key storage is~~ the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>

Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> One of the first [[authenticator]]s to support the [[FIDO2]] standard was the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>

[[Dropbox (service)|Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.<ref>{{cite web|url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/|title=Introducing WebAuthn support for secure Dropbox sign in|first=Brad|last=Girardeau|publisher=Dropbox|work=Dropbox Tech Blog|date=2018-05-08|accessdate=2018-05-11}}</ref>

== API ==

The WebAuthn API extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key ~~authenticators~~ as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in).

The WebAuthn API extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key [[authenticator]]s as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in).

To check if a browser supports WebAuthn, scripts should check if the <code>window.PublicKeyCredential</code> interface is defined. In addition to <code>PublicKeyCredential</code>, the standard also defines the <code>AuthenticatorResponse</code>, <code>AuthenticatorAttestationResponse</code>, and <code>AuthenticatorAssertionResponse</code> interfaces in addition to a variety of dictionaries and other datatypes.

@@ Line 3: / Line 3: @@
 WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters.
-WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an "authenticator", which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This, in general, is more secure, as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn effectively backward compatible with the [[Universal 2nd Factor]] (U2F) standard.
+WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an [[authenticator]], which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This, in general, is more secure, as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn effectively backward compatible with the [[Universal 2nd Factor]] (U2F) standard.
-WebAuthn as well as CTAP are both outgrowths of the FIDO2 project<ref name="fido2"/>, which  tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.
+WebAuthn as well as CTAP are both outgrowths of the [[FIDO2]] project<ref name="fido2"/>, which  tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.
 == Application and device support ==
 The WebAuthn Level 1 standard was published as a Proposed Recommendation by the [[Web Authentication Working Group]] on January&nbsp;17, 2019.<ref name="webauthn"/> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/>
-Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> The first new token able to handle the new "FIDO2" style of key storage is the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>
+Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> One of the first [[authenticator]]s to support the [[FIDO2]] standard was the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>
 [[Dropbox (service)|Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.<ref>{{cite web|url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/|title=Introducing WebAuthn support for secure Dropbox sign in|first=Brad|last=Girardeau|publisher=Dropbox|work=Dropbox Tech Blog|date=2018-05-08|accessdate=2018-05-11}}</ref>
 == API ==
-The WebAuthn API extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key authenticators as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in).
+The WebAuthn API extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key [[authenticator]]s as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in).
 To check if a browser supports WebAuthn, scripts should check if the <code>window.PublicKeyCredential</code> interface is defined. In addition to <code>PublicKeyCredential</code>, the standard also defines the <code>AuthenticatorResponse</code>, <code>AuthenticatorAttestationResponse</code>, and <code>AuthenticatorAssertionResponse</code> interfaces in addition to a variety of dictionaries and other datatypes.

WebAuthn: Difference between revisions

wikipedia>Trscavo