WebAuthn: Difference between revisions
→Authentication: Adjusting sentences after the corresponding diagram was updated #WebAuthn #Web #Authentication #VulcanSphere |
→Authentication: Inverting #diagram #VulcanSphere |
||
| Line 58: | Line 58: | ||
* ''something you know:'' a secret such as a [[Personal identification number|PIN]], [[Password|passcode]] or swipe pattern | * ''something you know:'' a secret such as a [[Personal identification number|PIN]], [[Password|passcode]] or swipe pattern | ||
* ''something you are:'' a [[Biometrics|biometric]] such as fingerprint, face, iris or voice | * ''something you are:'' a [[Biometrics|biometric]] such as fingerprint, [[Facial recognition system|face]], iris or voice | ||
Regardless of mode, the authenticator never shares its secrets or biometric data with the website.<ref>{{Cite web|url=https://www.w3.org/TR/webauthn/Overview.html#user-verification|title=Web Authentication: An API for accessing Public Key Credentials Level 1 § Terminology: User Verification|date=4 March 2019|website=www.w3.org|publisher=W3C|access-date=2019-06-16|archive-date=7 June 2017|archive-url=https://web.archive.org/web/20170607122711/https://www.w3.org/TR/webauthn/Overview.html#user-verification|url-status=live}}</ref> Moreover, a single user's secret or biometric works with all websites, as the authenticator selects the correct [[Public-key cryptography|cryptographic key material]] to use for the service requesting authentication after user verification was completed successfully. | Regardless of mode, the authenticator never shares its secrets or biometric data with the website.<ref>{{Cite web|url=https://www.w3.org/TR/webauthn/Overview.html#user-verification|title=Web Authentication: An API for accessing Public Key Credentials Level 1 § Terminology: User Verification|date=4 March 2019|website=www.w3.org|publisher=W3C|access-date=2019-06-16|archive-date=7 June 2017|archive-url=https://web.archive.org/web/20170607122711/https://www.w3.org/TR/webauthn/Overview.html#user-verification|url-status=live}}</ref> Moreover, a single user's secret or biometric works with all websites, as the authenticator selects the correct [[Public-key cryptography|cryptographic key material]] to use for the service requesting authentication after user verification was completed successfully. | ||
| Line 104: | Line 104: | ||
===Authentication=== | ===Authentication=== | ||
[[File:Passwordless_Web_Authentication.svg|thumb|upright=1.2|right|A typical Web Authentication (WebAuthn) flow]] | [[File:Passwordless_Web_Authentication.svg|thumb|class=skin-invert|upright=1.2|right|A typical Web Authentication (WebAuthn) flow]] | ||
[[File:Android Credential Manager Conditional UI on Android screenshot (cropped).webp|thumb|upright=1.2|Example of WebAuthn authentication with Android Credential Manager]] | [[File:Android Credential Manager Conditional UI on Android screenshot (cropped).webp|thumb|upright=1.2|Example of WebAuthn authentication with Android Credential Manager]] | ||
Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses either a facial recognition, fingerprint or PIN for user verification, the authenticator itself is ''something you have'' while the facial recognition and fingerprint (biometric) are ''something you are'' and the PIN is ''something you know''. | Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses either a [[Facial recognition system|facial recognition]], fingerprint or PIN for user verification, the authenticator itself is ''something you have'' while the facial recognition and fingerprint (biometric) are ''something you are'' and the PIN is ''something you know''. | ||
To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> | To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> | ||