Jump to content

WebAuthn: Difference between revisions

From IdeaWazaWiki
← Older editNewer edit →

194.74.3.165 (talk)

No edit summary
Removed FIDO 2.0, because the project called FIDO2.
Line 1: Line 1:
'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated by [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.
'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated by [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.


WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]], or an external hardware token accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and is designed to work with the in-progress [[Client-to-Authenticator Protocol]] (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the "FIDO2" (or "FIDO 2.0") project.<ref name="fido2"/>
WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]], or an external hardware token accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and is designed to work with the in-progress [[Client-to-Authenticator Protocol]] (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the FIDO2 project.<ref name="fido2"/>


==Application and device support==
==Application and device support==

Revision as of 14:18, 2 September 2018

WebAuthn (Web Authentication) is an effort by the World Wide Web Consortium (W3C),[1][2] with input from the FIDO Alliance,[3] to standardize an interface for public-key authentication of users to web-based applications and services. It implements an extension of the W3C's more general Credential Management API, which is an attempt to formalize the interaction between websites and in-browser password managers that store username/password combinations or other "federated" credentials such as authentication tokens generated by single sign-on services. However, WebAuthn is intended to work with multi-factor authentication, possibly in completely passwordless schemes that use gestures or biometric verification instead of requiring users to type in long, complex strings of characters.

WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's trusted execution environment, a Trusted Platform Module, or an external hardware token accessed via USB, Bluetooth Low Energy, or near-field communications (NFC). This builds upon the FIDO Alliances's previous Universal Authentication Framework (UAF) and Universal 2nd Factor (U2F) standards, and is designed to work with the in-progress Client-to-Authenticator Protocol (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the FIDO2 project.[3]

Application and device support

The WebAuthn Level 1 standard was published as a Candidate Recommendation by the Web Authentication Working Group on March 20, 2018.[1] The desktop version of Google Chrome has supported WebAuthn since version 67.[4] Mozilla Firefox, which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.[5] The current Windows Insider release of Microsoft Edge implements a version of WebAuthn that works with both Windows Hello as well as external Security Keys.[6] Support that matches the published standard is expected later in 2018.[4]

Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.[1] The first new token able to handle the new "FIDO2" style of key storage is the second-generation Security Key by Yubico, announced on April 10, 2018.[7]

Dropbox announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.[8]

API

The WebAuthn API extends the Credential Management navigator.credentials.create() and navigator.credentials.get() JavaScript methods so they accept a publicKey parameter. The create() method is used for registering public key authenticators as part of associating them with user accounts (possibly at initial account creation time, but more likely when adding a new security device to an existing account), and the get() method is used for authenticating (such as when logging in).

To check if a browser supports WebAuthn, scripts should check if the window.PublicKeyCredential interface is defined. In addition to PublicKeyCredential, the standard also defines the AuthenticatorResponse, AuthenticatorAttestationResponse, and AuthenticatorAssertionResponse interfaces in addition to a variety of dictionaries and other datatypes.

The API does not allow direct access to or manipulation of private keys, beyond requesting their initial creation.

References

  1. ↑ 1.0 1.1 1.2 Balfanz, et. al. (2018-03-20). "Web Authentication: An API for accessing Public Key Credentials Level 1". W3C. https://www.w3.org/TR/webauthn/. Retrieved on 2018-05-11. 
  2. ↑ "Web Authentication Working Group". W3C. https://www.w3.org/blog/webauthn/. Retrieved on 2018-05-11. 
  3. ↑ 3.0 3.1 "FIDO2 Project". FIDO Alliance. https://fidoalliance.org/fido2/. Retrieved on 2018-05-11. 
  4. ↑ 4.0 4.1 Brand, Christiaan (2018-06-03). "Enabling Strong Authentication with WebAuthn". https://developers.google.com/web/updates/2018/05/webauthn. Retrieved on 2018-06-25. 
  5. ↑ Shankland, Stephen (2018-05-09). "Firefox moves browsers into post-password future with WebAuthn tech". https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/. Retrieved on 2018-05-11. 
  6. ↑ Sarkar, et. al. (2018-05-23). "Announcing Windows 10 Insider Preview Build 17682". Microsoft. https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97. Retrieved on 2018-06-25. 
  7. ↑ Template:Cite press release
  8. ↑ Girardeau, Brad (2018-05-08). "Introducing WebAuthn support for secure Dropbox sign in". Dropbox Tech Blog. Dropbox. https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/. Retrieved on 2018-05-11. 
Retrieved from "https://ideawaza.com/index.php?title=WebAuthn&oldid=120057"