W3C WebAuthn

W3C WebAuthn W3C WebAuthn is a web standard for public-key authentication that enables passwordless, phishing-resistant sign-in on World Wide Web Consortium, designed to work with platform and roaming authenticators such as hardware tokens and platform keys. The specification defines APIs used by Google, Mozilla, Microsoft, and other vendors to integrate authenticators into browsers and operating systems, aligning with initiatives from FIDO Alliance and standards work at Internet Engineering Task Force. Major deployments include services by PayPal, GitHub, Dropbox, and financial institutions collaborating with EMVCo and national identity programs like Gov.uk and eIDAS-related projects.

Overview

WebAuthn specifies a browser-facing API enabling relying parties such as Amazon (company), Facebook, Twitter, LinkedIn, and Salesforce to create and use public-key credentials for users. Implementations use authenticators manufactured by vendors including Yubico, Feitian Technologies, Apple Inc., Samsung Electronics, and Intel Corporation to store private keys and perform cryptographic operations, often leveraging secure elements from ARM Holdings and Qualcomm. Adoption is shaped by online service providers like Google Drive, Microsoft 365, Dropbox Business, content platforms like YouTube and Netflix, and government services in jurisdictions represented by European Commission, US Department of Homeland Security, and Japan Ministry of Internal Affairs and Communications.

Technical Architecture

The technical architecture links web client components in browsers such as Google Chrome, Mozilla Firefox, Microsoft Edge, and Safari with authenticators implemented in hardware and software by Yubico, Apple, Samsung, and Lenovo. WebAuthn relies on public-key cryptography standards from NIST, algorithms specified by IETF documents like RFC 8032 and RFC 8446, and attestation formats common to FIDO Alliance metadata services used by NIST SP 800-63B compliance programs. The API surfaces include JavaScript interfaces invoked by sites hosted on infrastructures such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure, and communicate using data structures influenced by JSON Web Token and CBOR encodings developed in contexts involving Internet Engineering Task Force working groups.

Authentication Flows

Typical flows include registration (credential creation) and assertion (authentication) between relying parties like GitHub, Slack, Salesforce and user agents such as ChromeOS, Windows 10, macOS, and Android. During registration, a relying party generates a challenge and requests attestation from authenticators produced by Yubico, Feitian, or Google; attestation may reference device manufacturers like Intel or Qualcomm and certification schemes run by FIDO Alliance and evaluators accredited by Common Criteria labs. During assertion, the authenticator signs a challenge, producing signatures verifiable with public keys stored by services such as PayPal, Stripe (company), Shopify, and Square, Inc. for single-factor or multi-factor schemes integrated with identity providers like Okta and Auth0.

Security and Privacy Considerations

Security properties derive from asymmetric cryptography informed by standards from NIST, threat models considered by ENISA, and incident analyses from operators like Cloudflare and Akamai Technologies. WebAuthn reduces phishing risk cited in reports from Verizon, Cisco, and Mandiant by binding credentials to origins managed by IETF protocols including HTTP/1.1 and HTTPS practices advocated by Let's Encrypt. Privacy controls address attestation and device fingerprinting concerns raised by civil groups such as Electronic Frontier Foundation and regulators like European Data Protection Board, aligning with regional laws including General Data Protection Regulation and initiatives by National Institute of Standards and Technology.

Implementations and Browser Support

Browser vendors Google, Mozilla Foundation, Microsoft Corporation, and Apple Inc. provide WebAuthn support in Chrome, Firefox, Edge, and Safari respectively, coordinating with platform teams at Microsoft Azure, Apple Developer Program, and Google Play Services for mobile. Authenticator vendors like Yubico, Feitian Technologies, Thales Group, and Gemalto produce FIDO-compliant devices; enterprise IAM solutions from Okta, Ping Identity, and ForgeRock integrate WebAuthn into single sign-on flows for customers such as Adobe and IBM. Compliance testing and certification are provided by FIDO Alliance labs and security firms including Deloitte and KPMG.

Use Cases and Adoption

Use cases span consumer platforms like Google Accounts, Microsoft Account, and Apple ID, enterprise SSO for organizations like Deloitte, Accenture, and PwC, and government e‑services in projects run by Gov.uk Verify and national digital identity initiatives in Estonia and Singapore. Financial services adopting WebAuthn include Visa, Mastercard, American Express, and banks participating in Open Banking and PSD2 ecosystems. Content platforms such as GitHub, Reddit, and Stack Overflow use WebAuthn for high-assurance account recovery and privileged access for administrators.

Standards Development and History

The WebAuthn specification was developed by the World Wide Web Consortium Web Authentication Working Group in collaboration with the FIDO Alliance, with contributors from Google, Microsoft, Mozilla, Yubico, and Amazon. Its evolution referenced IETF documents like RFC 7515 and standards from NIST and harmonized with attestation metadata efforts by FIDO Alliance and certification frameworks involving Common Criteria and CCRA-related schemes. Milestones include incorporation into browser releases by Google Chrome 67, Firefox 60, and platform integrations announced at industry events such as RSA Conference and Black Hat USA.

Category:Web standards