[webauthn] Use aPAKE/QPAQUE for FIDO multi-device credentials (PassKey) (#1747)

Sebastian-Elfors-IDnow has just created a new issue for https://github.com/w3c/webauthn:

== Use aPAKE/QPAQUE for FIDO multi-device credentials (PassKey) ==
The [OPAQUE Asymmetric PAKE Protocol](https://cfrg.github.io/draft-irtf-cfrg-opaque/draft-irtf-cfrg-opaque.html) has recently been published by the IETF Network Working Group.

In particular, the section "[Client Credential Storage and Recovery](https://cfrg.github.io/draft-irtf-cfrg-opaque/draft-irtf-cfrg-opaque.html#name-client-credential-storage-a)" is interesting, because that part specifies how a client can encrypt its private key in an envelope and store it on the server together with the server's public key. The user uses a PIN-code to encrypt the envelope that is then stored at the server. The client can thus download its envelope and decrypt it with a PIN-code. The recovered private key can then be stored in the mobile's TPM/TEE. Furthermore, the client can use the server's public key to authenticate to the server and to create a session key.

This could perhaps be a standardized option for roaming of FIDO multi-device credentials (PassKey)? Perhaps it can be mentioned as an implementation example (or similar) in the WebAuthn standard?

Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1747 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 15 June 2022 08:25:31 UTC