WebAuthn: Difference between revisions
No edit summary |
ce |
||
| Line 79: | Line 79: | ||
[[File:Android Credential Manager Conditional UI on Android screenshot (cropped).webp|thumb|upright=1.2|Example of WebAuthn authentication with Android Credential Manager]] | [[File:Android Credential Manager Conditional UI on Android screenshot (cropped).webp|thumb|upright=1.2|Example of WebAuthn authentication with Android Credential Manager]] | ||
Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the | Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the website. Assuming the authenticator uses either a [[Facial recognition system|facial recognition]], fingerprint or PIN for user verification, the authenticator itself is ''something you have'' while the facial recognition and fingerprint (biometric) are ''something you are'' and the PIN is ''something you know''. | ||
To initiate the | To initiate the authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the website indicates its intentions to the web browser via [[JavaScript]]. The web browsercommunicates with the authenticator using a JavaScript [[API]] implemented in the browser. A authenticator in the user's posession conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP),<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> and connects over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the web browserDevice) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | ||
WebAuthn Hybrid Transport allows the | WebAuthn Hybrid Transport allows the web browser to access credentials stored on another authenticator such as a smartphone, useful in certain situations where credential sync is not viable.<ref name="Corbado-HybridTransport" /> | ||
There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | ||
| Line 91: | Line 91: | ||
===Registration=== | ===Registration=== | ||
When the | When the website receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. | ||
To obtain a public key for the user, the | To obtain a public key for the user, the website initiates a WebAuthn registration flow<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Registration Registration] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> that is similar to the authentication flow illustrated above. The primary difference is that the authenticator now signs an attestation statement with its attestation private key. The signed attestation statement contains a copy of the public key that the website ultimately uses to verify a signed authentication assertion. The attestation certificate contains metadata describing the authenticator itself.<ref>{{Cite web |date=2025-05-28 |title=Attestation and Assertion - Web APIs |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion |access-date=2025-09-20 |website=[[MDN Web Docs]] |language=en-US}}</ref> | ||
The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the | The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the website obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.<ref>{{cite web |title=Metadata Service |date=15 September 2015 |url=https://fidoalliance.org/metadata/ |publisher=[[FIDO Alliance]] |access-date=18 March 2019}}</ref> | ||
The attestation type specified in the JavaScript determines the trust model. For instance, an attestation type called self-attestation may be desired, for which the trust model is essentially [[trust on first use]]. | The attestation type specified in the JavaScript determines the trust model. For instance, an attestation type called self-attestation may be desired, for which the trust model is essentially [[trust on first use]]. | ||