Web Authentication API

All Rights Reserved | FIDO Alliance | Copyright 20181
FKWG
FIDO Technical Seminar
W3C - Web Authentication API
ETRI
김석현
2018. 07. 16

Overview
● Web Authentication API(FIDO2) usage scenarios
● Web Authentication API Configuration, Characteristics and Attestation
● FIDO2 registration, authentication flow and Extensions
Relying PartyUser Agent
RP Client RP Server
FIDO Server
Web Authentication API
(JavaScript API)
CTAP
Platform
Authenticator
Browser
Platform
Cross-Platform
Authenticator

AGENDA
1. Use Cases
2. Web Authentication API

Use Cases
1. Platform Authenticator
2. Cross-Platform Authenticator

Use Cases – Platform Authenticator
● User experience (Authentication - Any credential)
https://example.com https://example.com
Please complete
the authentication.
Sign in
Alice,
authentication complete.
Welcome to
example.com
Sign in as
Alice
Bob
● FIDO2 Service Requirements
○ Web pages (using web authentication API)
○ FIDO2 Server

Use Cases – Cross-Platform Authenticator
● User experience (Authentication - Any credential)
Please complete
this action on your
phone.Sign in with your phone
https://example.com
Alice,
authentication complete.
Welcome to
example.com
● FIDO2 Service Requirements
○ Web pages (using web authentication API)
○ FIDO2 Server
○ Device (supporting CTAP-FIDO2 Authenticator)
Sign in to
example.com
Sign in as
Alice
Bob
Authorization
gesture
CTAP

1. WebAuthn API
2. Attestations
3. Registration
4. Authentication
5. Extentions

WebAuthn API 1/3
● WebAuthn API
○ The API provides the ability to register with a public key credential scoped to the site
through a web browser and to authenticate using a registered credential.
○ (Registration) Navigator.credentials.create()
○ (Authentication) Navigator.credentials.get()
● PublicKeyCredential inherits from Credential
○ Credential is a W3C Credential Management API for all types of credentials
■ http://www.w3.org/TR/credential-management-1/
● Public key credentials, each scoped to a given Relying Party are created and
stored on an authenticator.
○ Each authenticator stores a credentials map, a map from (rpId, [userHandle]) to public
key credential.

WebAuthn API 2/3
● PublicKeyCredential Interface
[SecureContext, Exposed=Window]
Interface PublicKeyCredential : Credential
{
[SameObject] readonly attribute ArrayBuffer rawId;
[SameObject] readonly attribute AuthenticatorResponse response;
AuthenticationExtensionsClientOutputs getClientExtensionResults();
};
○ Id, type
■ This attribute is inherited from Credential.
○ rawId
■ This attribute returns the ArrayBuffer contained in the [[identifier]] internal slot.
○ Response
■ (registration) AuthenticatorAttestationResponse
■ (authentication) AuthenticatorAssertionResponse
○ getClientExtensionResults()
■ This operation returns the value of [[clientExtensionsResults]].

WebAuthn API 3/3
● Platform (browser or OS)
○ Contextual(channel) bindings of both the Relying Party and the client platform.
○ Configure the CollectedClientData.
dictionary CollectedClientData
{
required DOMString type;
required DOMString challenge;
required DOMString origin;
TokenBinding tokenBinding;
};
Browser
FIDO2 Server
Authenticator
clientDataHash Signature
(clientDataHash)
- clientDataJSON
- Signature
The clientDataHsh is the hash of the CollectedClientDataJSON using SHA-256.

1. WebAuthn API
2. Attestations
3. Registration
4. Authentication
5. Extentions

Attestation statement format
● Packed Attestation
○ WebAuthn optimized attestation statement format.
○ It is implementable by authenticators with limited sources (e.g., secure elements).
● TPM Attestation
○ This attestation statement format is generally used by authenticators that use a
Trusted Platform Module as their cryptographic engine.
● Android Key Attestation
○ When the authenticator in question is a platform-provided Authenticator on the
Android “N”or later platform, the attestation statement is based on the Android Key
attestation.
● Android SafetyNet Attestation
○ When the authenticator in question is a platform-provided Authenticator on certain
Android platforms, the attestation statement is based on the SafetyNet API.
● FIDO U2F Attestation
○ FIDO U2F authenticators using the formats defined in FIDO-U2F-Message-Formats
specification.
● None Attestation

Attestation Object
“authData”: … “fmt”:”packed” “attStmt”:…
RP ID Hash FLAGS COUNTER ATTESTED CRED. DATA EXTENSIONS
Authentication Data
AAGUID L CREDENTIAL ID CREDENTIAL PUBLIC KEY
“alg”:… “sig”:… “x5c”:…
Attestation Statement (packed)
if Basic or Attestation CA:
“alg”:… “sig”:… “ecdaaKeyId”:…if ECDAA
Attestation Object
● The basic requirement is that the authenticator can produce, for each credential
public key, an attestation statement verifiable by the Relying Party.

Attestation type
● Attestation type in metadata statement
○ Basic Attestation (Basic full)
○ Self Attestation (Surrogate)
○ Attestation CA (Privacy CA)
○ Elliptic Curve based Direct Anonymous Attestation (ECDAA)
● AttestationConveyancePreference handled by platform
○ none, indirect, direct

Attestation trustworthiness
Relying PartyUser Agent
FIDO ServerAuthenticator
Metadata Service
Authentication
by RP
PubKey
PriKey
Cert
PriKey
Attestation
Issue Attestation Certificate
Root CA
Root CA Certificate

1. WebAuthn API
2. Attestations
3. Registration
4. Authentication
5. Extentions

Registration
● JavaScript API
○ Navigator.credentials.create({PublicKeyCredentialCreationOptions})
dictionary PublicKeyCredentialCreationOptions
{
required PublicKeyCredentialRpEntity rp;
required PublicKeyCredentialUserEntity user;
required BufferSource challenge;
required sequence< PublicKeyCredentialParameters > pubKeyCredParams;
unsigned long timeout;
sequence< PublicKeyCredentialDescriptor > excludeCredentials = [];
AuthenticatorSelectionCriteria authenticatorSelection;
AttestationConveyancePreference attestation = “none”;
AuthenticationExtensionsClientInputs extensions;
};

Navigator.credential.create() 1/2
if (!window.PublicKeyCredential) { /* Platform not capable. Handle error. */ }
var publicKey = {
// The challenge must be produced by the server, see the Security Considerations
challenge: new Uint8Array([21,31,105 /* 29 more random bytes generated by the server */]),
// Relying Party:
rp: {
name: "ACME Corporation"
},
// User:
user: {
id: Uint8Array.from(window.atob("MIIBkzCCATigAwIBAjCCAZMwggE4oAMCAQIwggGTMII="), c=>c.charCodeAt(0)),
name: "alex.p.mueller@example.com",
displayName: "Alex P. Müller",
icon: "https://pics.example.com/00/p/aBjjjpqPb.png"
},

Navigator.credential.create() 2/2
// This Relying Party will accept either an ES256 or RS256 credential, but prefers an ES256 credential.
pubKeyCredParams: [
{
type: "public-key",
alg: -7 // "ES256" as registered in the IANA COSE Algorithms registry
},
{
type: "public-key",
alg: -257 // Value registered by this specification for "RS256"
}
],
timeout: 60000, // 1 minute
excludeCredentials: [], // No exclude list of PKCredDescriptors
extensions: {"loc": true} // Include location information in attestation
};
// Note: The following call will cause the authenticator to display UI.
navigator.credentials.create({ publicKey }).then(function (newCredentialInfo) {
// Send new credential info to server for verification and registration.
}).catch(function (err) {
// No acceptable authenticator or user refused consent. Handle appropriately.
});

Registration - Platform authenticator
if (!window.PublicKeyCredential) { /* Platform not capable of the API. Handle error. */ }
PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()
.then(function (userIntent) {
// If the user has affirmed willingness to register with RP using an available platform authenticator
if (userIntent) {
var publicKeyOptions = { /* Public key credential creation options. */};
// Create and register credentials.
return navigator.credentials.create({ "publicKey": publicKeyOptions });
} else {
// Record that the user does not intend to use a platform authenticator
// and default the user to a password-based flow in the future.
}
}).then(function (newCredentialInfo) {
// Send new credential info to server for verification and registration.
}).catch( function(err) {
// Something went wrong. Handle appropriately.
});

1. WebAuthn API
2. Attestations
3. Registration
4. Authentication
5. Extentions

Authentication
● JavaScript API
○ Navigator.credentials.get({“publicKey”:PublicKeyCredentialRequestOptions})
dictionary PublicKeyCredentialRequestOptions
{
required BufferSource challenge;
unsigned long timeout;
USVString rpId;
sequence< PublicKeyCredentialDescriptor > allowCredentials = [];
UserVerificationRequirement userVerification = “preferred”;
AuthenticationExtensionsClientInputs extensions;
};

AuthenticatorAssertionResponse
● This response contains a cryptographic signature proving possession of the
credential private key, and optionally evidence of user consent to a specific
transaction.
Interface AuthenticatorAssertionResponse : AuthenticatorResponse
{
[SameObject] readonly attribute ArrayBuffer authenticatorData;
[SameObject] readonly attribute ArrayBuffer signature;
[SameObject] readonly attribute ArrayBuffer? userHandle;
};
Interface AuthenticatorResponse
{
[SameObject] readonly attribute ArrayBuffer clientDataJSON;
};

Navigator.credential.get() 1/3
var options = {
allowCredentials: [{ type: "public-key" }]
};
navigator.credentials.get({ "publicKey": options })
.then(function (assertion) {
// Send assertion to server for verification
// No acceptable credential or user refused consent. Handle appropriately.
});
● Any Credential

● Credential Hint
var encoder = new TextEncoder();
var acceptableCredential1 = {
type: "public-key",
id: encoder.encode("!!!!!!!hi there!!!!!!!n")
};
var acceptableCredential2 = {
type: "public-key",
id: encoder.encode("roses are red, violets are bluen")
};

● Credential Hint
var options = {
allowCredentials: [acceptableCredential1, acceptableCredential2],
extensions: { 'txAuthSimple': "Wave your hands in the air like you just don’t care" }
};
navigator.credentials.get({ "publicKey": options })
.then(function (assertion) {
// Send assertion to server for verification
// No acceptable credential or user refused consent. Handle appropriately.
});

1. WebAuthn API
2. Attestations
3. Registration
4. Authentication
5. Extentions

Extensions
● The mechanism for generating public key credentials and Authentication assertions.
● Defined Extensions. The browser has the option to implement an extension or not since this
is a client extension.
○ FIDO AppID (appId)
■ This allows Relying Parties that have previously registered a credential using the legacy FIDO JavaScript
APIs to request an assertion.
○ Simple Transaction Authorization (txAuthSimple)
○ Generic Transaction Authorization (txAuthGeneric)
○ Authenticator Selection (authnSel)
■ Relying Parties that wish to tightly control the experience around credential creation.
○ Supported Extensions (exts)
○ User Verification Index (uvi)
■ This allows the detection and prevention of "friendly fraud".
○ Location (loc)
○ User Verification Method (uvm)
■ for a multi-factor authentication (userVerification, keyProtection, matcherProtection)
○ Biometric Authenticator Performance Bounds (biometricPerfBounds)

감사합니다.

Web Authentication API

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Web Authentication API

Similar to Web Authentication API (20)

More from FIDO Alliance

More from FIDO Alliance (20)

Recently uploaded

Recently uploaded (20)

Web Authentication API