Add registration/authentication extensions for cloud-assisted BLE #909

kpaulh · 2018-05-15T18:39:22Z

This is a counterpart to https://github.com/fido-alliance/fido-2-specs/pull/529/, the FIDO2 cloud-assisted BLE PR. We're not quite sure where the extension should live - FIDO2 or WebAuthN. We're leaning towards WebAuthN, since it is relevant to RPs, but hoping others have some thoughts.

Also, this PR currently has references to sections in the FIDO2 spec that I can either replace with complete explanations or update links to once they're available in the FIDO spec. We figured we would get eyes on it now and clean up along the way.

Note that since this is the first registration extension, this PR also adds RegistrationExtensionsClientInputs/Outputs.

Preview | Diff

nadalin · 2018-05-16T17:11:34Z

@kpaulh Will review @ the FIDO Plenary

selfissued

I believe that this extension does belong in WebAuthn, although it would be OK for it to be in CTAP instead. In either case, it will end up in the IANA "Extension Identifiers" registry - so the result would be the same.

The creation of the "RegistrationExtensions..." identifiers reflects a misunderstanding. The word "Authentication" in the "AuthenticationExtensions..." identifiers refers to "Web Authentication" - not a particular method. The existing identifiers apply and should be used.

selfissued · 2018-05-23T10:28:15Z

index.bs

+    };
+</xmp>
+
+This is a dictionary containing the [=client extension output=] values for zero or more WebAuthn extensions, as defined in [[#extensions]].


Delete RegistrationExtensionsClientOutputs. Use AuthenticationExtensionsClientOutputs instead.

Done! sorry for the confusion.

selfissued · 2018-05-23T10:28:35Z

index.bs

+    };
+</xmp>
+
+This is a dictionary containing the [=client extension input=] values for zero or more WebAuthn extensions, as defined in [[#extensions]].


Delete RegistrationExtensionsClientInputs. Use AuthenticationExtensionsClientInputs instead.

selfissued · 2018-05-23T10:29:06Z

index.bs

+    typedef record<DOMString, DOMString> RegistrationExtensionsAuthenticatorInputs;
+</xmp>
+
+This is a dictionary containing the [=authenticator extension input=] values for zero or more WebAuthn extensions, as defined in [[#extensions]].


Delete RegistrationExtensionsAuthenticatorOutputs. Use AuthenticationExtensionsAuthenticatorOutputs instead.

selfissued · 2018-05-23T10:29:44Z

index.bs

+      required BufferSource rpPublicKey;
+    };
+
+    partial dictionary RegistrationExtensionsClientInputs {


Registration -> Authentication

nadalin · 2019-02-13T17:26:55Z

@jcjones @akshayku @equalsJeffH Please review

equalsJeffH · 2019-03-06T01:04:18Z

Just to note wrt

We're not quite sure where the[se] extension[s] should live - FIDO2 or WebAuthN

Just to note, presently these extension definitions are also contained in https://github.com/fido-alliance/fido-2-specs/pull/529/ [ which is for the CTAP spec ]. If we decide to land them here in the WebAuthn spec, we will need to update https://github.com/fido-alliance/fido-2-specs/pull/529/ such that they (specifically only the extension definitions) are elided (from the latter CTAP-specific PR).

jcjones · 2019-03-07T19:12:03Z

index.bs

+
+During <code>authenticatorGetAssertion()</code>, the RP provides the
+client with the necessary session data via the following extension.
+For details refer to Sections [#cable-eid] and [#cable-encryption].


I don't think these anchors exist?

equalsJeffH

LGTM, thanks Kim!!

nadalin · 2019-03-13T17:13:24Z

We will leave open until the CTAP work is implemented and make sure this works with passwordless world

ynojima · 2019-04-13T13:46:19Z

index.bs

+    };
+    </xmp>
+
+    Versions is a list of protocol versions supported by the relying party.


Could you elaborate the version ? What value is supported here?

For now only "1", but the field exists so that we can make changes/fixes to the protocol if needed.

ynojima · 2019-04-13T13:50:44Z

index.bs

+
+    Versions is a list of protocol versions supported by the relying party.
+
+    The rpPublicKey is an ECDH P-256 public key.


What format is used for encoding rpPublicKey?

ynojima · 2019-04-13T14:02:43Z

index.bs

+
+    The clientEid is a 16-byte EID advertised by the Client.
+
+    The authenticatorEid is a 16-byte EID advertised by the Authenticator.


How does the RP retrieve the EID advertised by the Authenticator?

ynojima · 2019-05-25T15:39:05Z

It seems AuthenticatorTransport enum should have cable value.

Chrome implementation does.
https://github.com/chromium/chromium/blob/e4aee4ff3c5981448f8b9cbc9bc948f005d86392/third_party/blink/renderer/modules/credentialmanager/public_key_credential_descriptor.idl#L11

equalsJeffH · 2020-01-08T20:10:08Z

we are closing this because we are hoping it will not be needed.

equalsJeffH · 2020-02-26T19:47:33Z

at 2020-02-26 meeting, we decided to close this because we are sure it wont be needed.

zbot473 · 2020-05-22T03:17:45Z

@equalsJeffH What is the standard for this then?
How will smartphone auth be done, or is that not the spec's job?

haishengwu-okta · 2022-03-24T16:24:01Z

Is this replaced by Bluetooth Smart / Bluetooth Low Energy Technology ?

kpaulh added 7 commits May 15, 2018 11:19

Add caBLE extensions

f5689a1

update extension

85b8b0d

Authentication takes an array of args

6c0f3d1

Capitalize dictionaries

467ca35

Arg => Data

1676fbc

Version is sequence. Renamed args -> data

e49f852

Add RegistrationExtension*

a78c82c

equalsJeffH self-requested a review May 16, 2018 17:10

nadalin assigned kpaulh May 16, 2018

nadalin mentioned this pull request May 16, 2018

Trim unnecessary step from appId extension #910

Merged

selfissued requested changes May 23, 2018

View reviewed changes

Don't use Registration*

5de1ef2

selfissued approved these changes May 23, 2018

View reviewed changes

nadalin added this to the L2-WD-00 milestone May 30, 2018

nadalin added the type:technical label May 30, 2018

emlun mentioned this pull request Jun 18, 2018

How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? #954

Closed

nadalin requested review from jcjones and akshayku January 16, 2019 18:38

Merge branch 'master' into cable

89fca9f

equalsJeffH mentioned this pull request Mar 6, 2019

Clarify the name AuthenticationExtensions... #1166

Closed

jcjones reviewed Mar 7, 2019

View reviewed changes

equalsJeffH approved these changes Mar 7, 2019

View reviewed changes

ynojima reviewed Apr 13, 2019

View reviewed changes

nadalin removed this from the L2-WD-01 milestone Apr 24, 2019

nadalin added this to the L2-WD-02 milestone Apr 24, 2019

Merge branch 'master' into cable

63be77d

equalsJeffH added the subtype:CTAP label Jun 19, 2019

emlun added the stat:Blocked Prerequisites are not yet satisfied label Jul 31, 2019

emlun mentioned this pull request Sep 2, 2019

webauthn should have the ability to cross platform #1290

Closed

nadalin modified the milestones: L2-WD-02, L2-WD-03 Sep 11, 2019

bdewater mentioned this pull request Oct 19, 2019

Clarify how a user can authenticate from multiple devices #151

Closed

nicksteele mentioned this pull request Nov 19, 2019

Authenticating over a phone (from a laptop) duo-labs/webauthn.io#21

Closed

equalsJeffH closed this Feb 26, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add registration/authentication extensions for cloud-assisted BLE #909

Add registration/authentication extensions for cloud-assisted BLE #909

kpaulh commented May 15, 2018 •

edited by pr-preview bot

nadalin commented May 16, 2018

selfissued left a comment

selfissued May 23, 2018

kpaulh May 23, 2018

selfissued May 23, 2018

kpaulh May 23, 2018

selfissued May 23, 2018

kpaulh May 23, 2018

selfissued May 23, 2018

kpaulh May 23, 2018

nadalin commented Feb 13, 2019

equalsJeffH commented Mar 6, 2019

jcjones Mar 7, 2019

equalsJeffH left a comment

nadalin commented Mar 13, 2019

ynojima Apr 13, 2019

arnar Jun 19, 2019

ynojima Apr 13, 2019

ynojima Apr 13, 2019

ynojima commented May 25, 2019 •

edited

equalsJeffH commented Jan 8, 2020

equalsJeffH commented Feb 26, 2020

zbot473 commented May 22, 2020

haishengwu-okta commented Mar 24, 2022


		Versions is a list of protocol versions supported by the relying party.

		The rpPublicKey is an ECDH P-256 public key.


		The clientEid is a 16-byte EID advertised by the Client.

		The authenticatorEid is a 16-byte EID advertised by the Authenticator.

Add registration/authentication extensions for cloud-assisted BLE #909

Add registration/authentication extensions for cloud-assisted BLE #909

Conversation

kpaulh commented May 15, 2018 • edited by pr-preview bot

nadalin commented May 16, 2018

selfissued left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nadalin commented Feb 13, 2019

equalsJeffH commented Mar 6, 2019

Choose a reason for hiding this comment

equalsJeffH left a comment

Choose a reason for hiding this comment

nadalin commented Mar 13, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ynojima commented May 25, 2019 • edited

equalsJeffH commented Jan 8, 2020

equalsJeffH commented Feb 26, 2020

zbot473 commented May 22, 2020

haishengwu-okta commented Mar 24, 2022

kpaulh commented May 15, 2018 •

edited by pr-preview bot

ynojima commented May 25, 2019 •

edited