用于加密的 Webauthn

Question

We have a project with a PWA where we want to implement client sided encryption. We wanted to use Webauthn as a second-factor in combination with passwords. In the background we use a randomly generated key to encrypt/decrypt the database, which is stored symmetrically encrypted with the password on the server. However I am struggling to find a good way to add encryption to this key with webauthn. My tries so far: Using raw JS samples from https://webauthn.guide , however I cannot find a part which is always the same and could be used for symmetric encryption/decryption, even the public key changes when logging in with the same USB token multiple times (???)

Using fido2-lib from npm : I couldn't get the sample to work, since the sample is not well documented and pretty long

Using server-sided authentication like spring webauthn , however I do not want the server to know anything about the client.

Any suggestions how I could implement an encryption with webauthn?

Answer 1

We have a project with a PWA where we want to implement client sided encryption. We wanted to use Webauthn as a second-factor in combination with passwords. In the background we use a randomly generated key to encrypt/decrypt the database, which is stored symmetrically encrypted with the password on the server. However I am struggling to find a good way to add encryption to this key with webauthn. My tries so far: Using raw JS samples from https://webauthn.guide , however I cannot find a part which is always the same and could be used for symmetric encryption/decryption, even the public key changes when logging in with the same USB token multiple times (???)

Using fido2-lib from npm : I couldn't get the sample to work, since the sample is not well documented and pretty long

Using server-sided authentication like spring webauthn , however I do not want the server to know anything about the client.

Any suggestions how I could implement an encryption with webauthn?

Answer 2

Years after this question, the hmac-secret extension has arrived.

This extension binds a secret to a Webauthn credential. This secret can be used to decrypt or encrypt data on client side.

Another approach could be the use of the largeBlob to store a secret generated during the creation ceremony. Note that the availability of those extensions depends on the authenticator that is used and may fail.

Answer 3

You can learn from the following github repo,it has many Webauthn out of the box examples (see the tech it supports inside)

Here are some samples I found at github https://github.com/OwnID/samples

In addition,I read about FIDO,Webauthn and passkeys at passkeys.com

Everything about this cool tech is there