In the native case, the relying party running on the client device can also act as a WebAuthn client to make direct WebAuthn calls.
Relying parties are web or native applications that wish to consume strong credentials. The cast of characters in a combined WebAuthn/CTAP2 dance are: The light blue dotted arrows are light blue and dotted because the exact way in which platform APIs are exposed to clients is an implementation choice. When CTAP and WebAuthn are drawn, it looks something like the picture below. Once these client-specific keys are created, attestations can be requested and sent to the clients for the purposes of registration and authentication the type of signature performed by the private key reflects the user gesture performed. Authenticators securely create and locally store strong cryptographic keys at the request of clients, under the condition that the user must consent to the operation via the performance of a ‘user gesture’. Any interoperable client (such as a native app or browser) running on a given “client device” can use a standardized method to interact with any interoperable authenticator – which could mean a platform authenticator that is built into the client device or a roaming authenticator that is connected to the client device through USB, BLE, or NFC. The Big PictureĬTAP2 and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. The WebAuthentication (aka WebAuthn) spec lives at W3C (where the browser makers meet) while the Client-to-Authenticator (aka CTAP2) spec lives at the FIDO Alliance (where hardware and platform folks have joined to solve the problem of Fast IDentity Online). To understand how FIDO2 authenticators work, you need knowledge of two specifications in two different standards bodies. We will start with the industry standards perspective, and then at the end we will summarize how Microsoft implements the various roles. But what are the actual pieces of the puzzle and how do they fit? Read on for the big picture of how the W3C WebAuthn and FIDO2 CTAP2 specifications interact. This one relying party enables standards-based passwordless authentication at Xbox, Skype, and more. This is a great week to be working in Identity Standards, as we at Microsoft celebrate the release of our first ever WebAuthn Relying Party.
0 kommentar(er)
