Home

Web Authentication

Abstract

主要内容与FIDO一致，基于非对称密钥认证用户身份

Web Authentication API

Web Authentication

What is FIDO2 and Web Authentication?

注册关键数据流

  • client触发注册
  • relying party server将challenge和相关注册配置信息给到client
  • client组装相关信息给到authenticator
  • authenticator校验成功后，随机生成key pair，并基于上述信息生成attestation（其中包含signature，思路类似PKCS#10 CSR）
  • authenticator将公钥、attestation等信息给到client
  • client将authenticator提供的信息组装后给到relying party server
  • relying party server校验成功后，存储对应关键信息（例如credential id, 公钥等等）

register

认证关键数据流

  • client触发认证
  • relying party server将challenge和相关认证配置信息给到client
  • client将对应relying party id和data hash给到authenticator
  • authenticator校验成功后，针对data hash进行签名
  • authenticator将签名数据传给client
  • client将authenticator提供的信息组装后给到relying party server
  • relying party server校验成功后，client成功登录

auth

相关协议文档

RFC8264, RFC8265, RFC8266: PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols

Client to Authenticator Protocol (CTAP)

RFC7049: Concise Binary Object Representation (CBOR)

RFC8152: CBOR Object Signing and Encryption (COSE)

RFC8230: Using RSA Algorithms with CBOR Object Signing and Encryption (COSE) Messages

Published

11 August 2019

Tags


Share On