WebAuthn: Difference between revisions

Line 41:

}}

'''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref>

Its primary purpose is to build a system of authentication for web-based applications that solves or mitigates the issues of traditional password-based authentication.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref>

It defines an [[API]] for websites to [[Authentication#In computer science|authenticate]] users using WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref><ref>{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do.

[[~~Zero-knowledge proof|Zero-knowledge proofs~~]] ~~based on~~ [[~~public-key cryptography~~|~~public-key signature schemes~~]] ~~are used to register and authenticate~~ users ~~without the need to transmit or store private authenticating information (such as passwords) on servers.~~

It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]], eliminating the need to send passwords over the internet while also eliminating the need to store them on servers.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref>

~~Passwords are replaced by the so-called~~ WebAuthn '''Credentials''' which are generated client-side and stored in so-called '''Authenticators'''. WebAuthn supports both roaming authenticators (such as physical security keys) and platform authenticators (such as smartphones). While different types of credentials are supported, synced discoverable credentials (~~also known as~~ '''~~Passkeys~~'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref>) ~~are the most common ones~~.

Users can store and use their WebAuthn credentials from a variety of authenticator types, such as physical [[Security token|security keys]] or smartphones. Credentials are often synced between devices for ease-of-use, and in some circumstances they can remove the need for usernames.

~~WebAuthn is a core component~~ of the [[~~FIDO Alliance#FIDO2|FIDO2 Project~~]] ~~under the guidance of~~ the [[~~FIDO Alliance~~]].<ref name="~~fido2~~">{{cite web|url=https://~~fidoalliance~~.org/~~fido2~~/|title=~~FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11~~}}</ref>

On the client side, authenticators are abstract functional models that are mostly agnostic with respect to how the key material is managed. This makes it possible to implement support for WebAuthn purely in software, making use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to a roaming hardware authenticator that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). A roaming hardware authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP),<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019}}</ref> making WebAuthn effectively backward compatible with the FIDO [[Universal 2nd Factor]] (U2F) standard.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018}}</ref>

Line 52:

Line 51:

The WebAuthn Level 1 and 2 standards were published as [[W3C recommendation|W3C Recommendations]] on 4 March 2019 and 8 April 2021 respectively.<ref name="W3C-WebAuthn-Level-1">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 1 (latest) |url=https://www.w3.org/TR/webauthn-1/ |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019}}</ref><ref name="W3C-WebAuthn-announce">{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019 |date=4 March 2019}}</ref><ref name="W3C-WebAuthn-Level-2">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 2 |url=https://www.w3.org/TR/webauthn-2/ |access-date=27 November 2022 |publisher=[[World Wide Web Consortium]] |publication-date=8 April 2021 |edition=Latest}}</ref> A Level 3 specification is currently a ''First Public Working Draft'' (FPWD).<ref name="W3C-WebAuthn-Level-3">{{Cite web|editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 3 |url=https://www.w3.org/TR/webauthn-3/ |publisher=[[World Wide Web Consortium]] |access-date=24 December 2021 |publication-date=4 April 2021|edition=First Public Working Draft}}</ref>

WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref>

== Background ==

@@ Line 41: / Line 41: @@
 }}
 '''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref>
-Its primary purpose is to build a system of authentication for web-based applications that solves or mitigates the issues of traditional password-based authentication.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref>
+It defines an [[API]] for websites to [[Authentication#In computer science|authenticate]] users using WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref><ref>{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do.
-[[Zero-knowledge proof|Zero-knowledge proofs]] based on [[public-key cryptography|public-key signature schemes]] are used to register and authenticate users without the need to transmit or store private authenticating information (such as passwords) on servers.
+It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]], eliminating the need to send passwords over the internet while also eliminating the need to store them on servers.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref>
-Passwords are replaced by the so-called WebAuthn '''Credentials''' which are generated client-side and stored in so-called '''Authenticators'''. WebAuthn supports both roaming authenticators (such as physical security keys) and platform authenticators (such as smartphones). While different types of credentials are supported, synced discoverable credentials (also known as '''Passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref>) are the most common ones.
+Users can store and use their WebAuthn credentials from a variety of authenticator types, such as physical [[Security token|security keys]] or smartphones. Credentials are often synced between devices for ease-of-use, and in some circumstances they can remove the need for usernames.
-WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref>
 On the client side, authenticators are abstract functional models that are mostly agnostic with respect to how the key material is managed. This makes it possible to implement support for WebAuthn purely in software, making use of a processor's [[trusted execution environment]] or a [[Trusted Platform Module]] (TPM). Sensitive cryptographic operations can also be offloaded to a roaming hardware authenticator that can in turn be accessed via [[USB]], [[Bluetooth Low Energy]], or [[near-field communication]]s (NFC). A roaming hardware authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP),<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019}}</ref> making WebAuthn effectively backward compatible with the FIDO [[Universal 2nd Factor]] (U2F) standard.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018}}</ref>
@@ Line 52: / Line 51: @@
 The WebAuthn Level&nbsp;1 and 2 standards were published as [[W3C recommendation|W3C Recommendations]] on 4 March 2019 and 8 April 2021 respectively.<ref name="W3C-WebAuthn-Level-1">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level&nbsp;1 (latest) |url=https://www.w3.org/TR/webauthn-1/ |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019}}</ref><ref name="W3C-WebAuthn-announce">{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019 |date=4 March 2019}}</ref><ref name="W3C-WebAuthn-Level-2">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level&nbsp;2 |url=https://www.w3.org/TR/webauthn-2/ |access-date=27 November 2022 |publisher=[[World Wide Web Consortium]] |publication-date=8 April 2021 |edition=Latest}}</ref> A Level 3 specification is currently a ''First Public Working Draft'' (FPWD).<ref name="W3C-WebAuthn-Level-3">{{Cite web|editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 3 |url=https://www.w3.org/TR/webauthn-3/ |publisher=[[World Wide Web Consortium]] |access-date=24 December 2021 |publication-date=4 April 2021|edition=First Public Working Draft}}</ref>
+WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref>
 == Background ==

WebAuthn: Difference between revisions

wikipedia>Bend1010