WebAuthn: Difference between revisions

Line 1:

'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and ~~in-~~[[web browser|~~browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated~~]]" credentials such as authentication tokens generated by [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.

'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and [[web browser|web browsers]] when exchange user credentials.

WebAuthn ~~is designed so that it~~ can ~~work with~~ a ~~range of public~~-~~key authenticator mechanisms~~, ~~from pure software implementations~~ to those ~~using specialized hardware environments~~, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]]~~, or an~~ external hardware ~~token~~ accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). ~~This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and~~ is designed to work with the ~~in-progress~~ [[Client-to-Authenticator Protocol]] (CTAP) ~~for communicating~~ with ~~hardware authentication devices~~. WebAuthn ~~and~~ CTAP are both outgrowths of the FIDO2 project.<ref name="fido2"/>

WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters.

WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an "authenticator", which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in return be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC), which improves overall security as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn mostly backward compatible with the [[Universal 2nd Factor]] (U2F) standard.

WebAuthn as well as CTAP are both outgrowths of the FIDO2 project<ref name="fido2"/>, which tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.

==Application and device support==

@@ Line 1: / Line 1: @@
-'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and in-[[web browser|browser]] [[password manager]]s that store username/password combinations or other "[[federated identity|federated]]" credentials such as authentication tokens generated by [[single sign-on]] services. However, WebAuthn is intended to work with [[multi-factor authentication]], possibly in completely passwordless schemes that use gestures or [[biometric]] verification instead of requiring users to type in long, complex strings of characters.
+'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="webauthn">{{cite web|url=https://www.w3.org/TR/webauthn/|title=Web Authentication: An API for accessing Public Key Credentials Level 1|author=Balfanz, et. al.|publisher=W3C|date=2018-03-20|accessdate=2018-05-11}}</ref><ref>{{cite web|url=https://www.w3.org/blog/webauthn/|title=Web Authentication Working Group|accessdate=2018-05-11|publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and [[web browser|web browsers]] when exchange user credentials.
-WebAuthn is designed so that it can work with a range of public-key authenticator mechanisms, from pure software implementations to those using specialized hardware environments, such as a processor's [[trusted execution environment]], a [[Trusted Platform Module]], or an external hardware token accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). This builds upon the FIDO Alliances's previous [[Universal Authentication Framework]] (UAF) and [[Universal 2nd Factor]] (U2F) standards, and is designed to work with the in-progress [[Client-to-Authenticator Protocol]] (CTAP) for communicating with hardware authentication devices. WebAuthn and CTAP are both outgrowths of the FIDO2 project.<ref name="fido2"/>
+WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters.
+WebAuthn can be implemented in a variety of different ways, since the underlying cryptographic operations are performed by an "authenticator", which is an abstract functional model that is mostly agnostic on the details of how the key material is managed. This makes it possible to implement WebAuthn purely in software, but also to make use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to external hardware tokens that can in return be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC), which improves overall security as private key material is at no time accessible to software running on the host machine. The communication with external hardware tokens is designed to work with the [[Client-to-Authenticator Protocol]] (CTAP), making WebAuthn mostly backward compatible with the [[Universal 2nd Factor]] (U2F) standard.
+WebAuthn as well as CTAP are both outgrowths of the FIDO2 project<ref name="fido2"/>, which  tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.
 ==Application and device support==

WebAuthn: Difference between revisions

wikipedia>Karol Babioch