WebAuthn: Difference between revisions
Adding information about #WebAuthn Hybrid Transport #VulcanSphere |
→Registration: Adding a #reference #VulcanSphere |
||
| Line 121: | Line 121: | ||
When the WebAuthn Relying Party receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. | When the WebAuthn Relying Party receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. | ||
To obtain a public key for the user, the WebAuthn Relying Party initiates a WebAuthn registration flow<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Registration Registration] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> that is similar to the authentication flow illustrated above. The primary difference is that the authenticator now signs an attestation statement with its attestation private key. The signed attestation statement contains a copy of the public key that the WebAuthn Relying Party ultimately uses to verify a signed authentication assertion. The attestation | To obtain a public key for the user, the WebAuthn Relying Party initiates a WebAuthn registration flow<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Registration Registration] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> that is similar to the authentication flow illustrated above. The primary difference is that the authenticator now signs an attestation statement with its attestation private key. The signed attestation statement contains a copy of the public key that the WebAuthn Relying Party ultimately uses to verify a signed authentication assertion. The attestation certificate contains metadata describing the authenticator itself.<ref>{{Cite web |date=2025-05-28 |title=Attestation and Assertion - Web APIs |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion |access-date=2025-09-20 |website=[[MDN Web Docs]] |language=en-US}}</ref> | ||
The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the WebAuthn Relying Party obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.<ref>{{cite web |title=Metadata Service |url=https://fidoalliance.org/metadata/ |publisher=[[FIDO Alliance]] |access-date=18 March 2019}}</ref> | The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the WebAuthn Relying Party obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.<ref>{{cite web |title=Metadata Service |url=https://fidoalliance.org/metadata/ |publisher=[[FIDO Alliance]] |access-date=18 March 2019}}</ref> | ||