Difference between revisions of "Web Authentication Level 2"

From MgmtWiki
Jump to: navigation, search
(Normal Flow)
Line 10: Line 10:
 
# Challenge, user info, RP info
 
# Challenge, user info, RP info
 
# RP ID, client data hash
 
# RP ID, client data hash
 +
# User verification, new key pair
 
*Authentication
 
*Authentication
 
# Challenge
 
# Challenge
 
# RP ID, client data hash
 
# RP ID, client data hash
 +
# User verification
 +
 
==Referrences==
 
==Referrences==
  

Revision as of 20:53, 26 October 2020

Full Title

Web Authentication Level 2[1] enables the creation and use of strong, attested, scoped, public key cred by web applications for strongly authenticating users.

Context

  • This is designed for web applications, not native applications.
  • The current draft of the evolving standard is available here.

Normal Flow

Web Authentication API [1] Section 5

  • Registration
  1. Challenge, user info, RP info
  2. RP ID, client data hash
  3. User verification, new key pair
  • Authentication
  1. Challenge
  2. RP ID, client data hash
  3. User verification

Referrences

  1. 1.0 1.1 Dirk Balfanz + 19, Web Authentication: An API for accessing Public Key Credentials Level 2 W3C Working Draft, 2020-07-30 https://www.w3.org/TR/webauthn-2/#iface-pkcredential