WebAuthn: Difference between revisions
→Overview: add new section |
→Overview: links added |
||
| Line 13: | Line 13: | ||
== Overview == | == Overview == | ||
Like its predecessor FIDO U2F, W3C Web Authentication (WebAuthn) involves a website, a web browser, and an authenticator: | Like its predecessor FIDO U2F, W3C Web Authentication (WebAuthn) involves a [[website]], a [[web browser]], and an authenticator: | ||
* The website is a conforming WebAuthn Relying Party | * The website is a conforming WebAuthn Relying Party | ||
| Line 23: | Line 23: | ||
[[File:Passwordless_Web_Authentication.svg|thumb|right|A typical Web Authentication (WebAuthn) flow]] | [[File:Passwordless_Web_Authentication.svg|thumb|right|A typical Web Authentication (WebAuthn) flow]] | ||
For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In either case, the authenticator is a multi-factor cryptographic authenticator that uses public-key cryptography to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a PIN for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In either case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key_cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[personal identification number]] (PIN) for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | ||
The WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via JavaScript. The WebAuthn Client communicates with the authenticator using a JavaScript API implemented in the browser. The authenticator conforms to the FIDO [[Client to Authenticator Protocol]] 2.0. | The WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[Application programming interface|API]] implemented in the browser. The authenticator conforms to the FIDO [[Client to Authenticator Protocol]] 2.0. | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (implemented on a smartphone, e.g.) or a platform authenticator | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (implemented on a smartphone, e.g.) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device platform) may be used. Relevant examples of platform authenticators include Windows Hello and the [[Android operating system]]. | ||
The illustrated flow relies on PIN-based user verification, which is only a modest improvement over ordinary password authentication. The use of [[biometric]]s for user verification can significantly improve the usability of WebAuthn.{{Citation needed|date=March 2019}} | The illustrated flow relies on PIN-based user verification, which is only a modest improvement over ordinary password authentication. The use of [[biometric]]s for user verification can significantly improve the usability of WebAuthn.{{Citation needed|date=March 2019}} | ||