WebAuthn: Difference between revisions

Line 1:

'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C)<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref>, with input from the [[FIDO Alliance]]<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref>, to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.

'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.

WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]], or an external hardware token accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and is designed to work with the in-progress [[Client-to-Authenticator Protocol]] (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the "FIDO2" (or "FIDO 2.0") project.<ref name="fido2"/>

Line 6:

The WebAuthn Level 1 standard was published as a Candidate Recommendation by the [[Web Authentication Working Group]] on March 20, 2018.<ref name="webauthn"/> [[Google Chrome]] has supported WebAuthn since version 65, though it was disabled by default. It is planned to be enabled in version 67.<ref name="chrome-support">{{cite web|url=https://www.tomsguide.com/us/chrome-webauthn-support,news-26946.html|title=Chrome to Support New Password-Free Logins|first=Henry T.|last=Casey|website=Tom's Guide|date=2018-04-10|accessdate=2018-05-11}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> [[Microsoft Edge]] had implemented an iteration of the earlier FIDO2 API that interfaced with [[Windows Hello]], though it differed from the W3C specification in a number of ways.<ref>{{cite web|url=https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/device/web-authentication|title=Web authentication and Windows Hello|author=Carey, et. al.|publisher=Microsoft|work=Microsoft Edge Dev Guide|date=2018-02-08|accessdate=2018-05-11}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/>

Existing FIDO U2F hardware tokens are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> The first new token able to handle the new "FIDO2" style of key storage is the second-generation [[YubiKey|Security Key]] by Yubico, announced on April ~~10th~~, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>

Existing FIDO U2F hardware tokens are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> The first new token able to handle the new "FIDO2" style of key storage is the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>

==API==

Line 16:

==References==

==External links==

*[https://www.w3.org/TR/webauthn/ Web Authentication: An API for accessing Public Key Credentials Level 1]

*[https://www.w3.org/Webauthn/ Web Authentication Working Group]

@@ Line 1: / Line 1: @@
-'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C)<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref>, with input from the [[FIDO Alliance]]<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref>, to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.
+'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.
 WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]], or an external hardware token accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and is designed to work with the in-progress [[Client-to-Authenticator Protocol]] (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the "FIDO2" (or "FIDO 2.0") project.<ref name="fido2"/>
@@ Line 6: / Line 6: @@
 The WebAuthn Level 1 standard was published as a Candidate Recommendation by the [[Web Authentication Working Group]] on March 20, 2018.<ref name="webauthn"/> [[Google Chrome]] has supported WebAuthn since version 65, though it was disabled by default. It is planned to be enabled in version 67.<ref name="chrome-support">{{cite web|url=https://www.tomsguide.com/us/chrome-webauthn-support,news-26946.html|title=Chrome to Support New Password-Free Logins|first=Henry T.|last=Casey|website=Tom's Guide|date=2018-04-10|accessdate=2018-05-11}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> [[Microsoft Edge]] had implemented an iteration of the earlier FIDO2 API that interfaced with [[Windows Hello]], though it differed from the W3C specification in a number of ways.<ref>{{cite web|url=https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/device/web-authentication|title=Web authentication and Windows Hello|author=Carey, et. al.|publisher=Microsoft|work=Microsoft Edge Dev Guide|date=2018-02-08|accessdate=2018-05-11}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/>
-Existing FIDO U2F hardware tokens are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> The first new token able to handle the new "FIDO2" style of key storage is the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10th, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>
+Existing FIDO U2F hardware tokens are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="webauthn"/> The first new token able to handle the new "FIDO2" style of key storage is the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref>
 ==API==
@@ Line 16: / Line 16: @@
 ==References==
-{{refs}}
+{{reflist}}
 ==External links==
 *[https://www.w3.org/TR/webauthn/ Web Authentication: An API for accessing Public Key Credentials Level 1]
 *[https://www.w3.org/Webauthn/ Web Authentication Working Group]
+{{Uncategorized|date=May 2018}}

WebAuthn: Difference between revisions

wikipedia>IVORK