WebAuthn: Difference between revisions
Update Level 3 spec status in lead (FPWD → Candidate Recommendation → proposed for Recommendation, per W3C news) |
→Overview: Add "Level 3" subsection covering PRF extension, Related Origin Requests, and cross-origin privacy provisions |
||
| Line 99: | Line 99: | ||
WebAuthn specifies how a claimant demonstrates possession and control of a FIDO2 authenticator to a verifier called the WebAuthn Relying Party. The authentication process is mediated by an entity called the WebAuthn Client, which is little more than a conforming web browser. | WebAuthn specifies how a claimant demonstrates possession and control of a FIDO2 authenticator to a verifier called the WebAuthn Relying Party. The authentication process is mediated by an entity called the WebAuthn Client, which is little more than a conforming web browser. | ||
=== Level 3 === | |||
WebAuthn Level 3 introduces several capabilities beyond authentication alone. The PRF (Pseudo-Random Function) extension allows a passkey to derive encryption keys, enabling it to help protect encrypted data such as backups without a separate password.<ref name="enpass-webauthn3">{{Cite web |title=What Is WebAuthn Level 3 & How Does Enpass Support It? |url=https://www.enpass.io/blog/security/what-is-webauthn-level-3-how-does-enpass-support-it/ |publisher=Enpass |date=23 July 2026 |access-date=20 August 2026}}</ref> Related Origin Requests (ROR) let a single passkey be used across multiple domains belonging to the same organization, reducing the need for duplicate credentials.<ref name="enpass-webauthn3" /> | |||
The specification also added a section addressing the privacy implications of using WebAuthn credentials across origins, including risks associated with cross-origin iframes.<ref>{{Cite web |title=[L3 REC] Transition Request Draft |url=https://github.com/w3c/webauthn/issues/2399 |publisher=GitHub |website=w3c/webauthn |access-date=20 August 2026}}</ref> | |||
===Authentication=== | ===Authentication=== | ||