WebAuthn

WebAuthn enables passwordless login by replacing shared secrets with unique cryptographic key pairs. Users authenticate using a possession factor (like a security key or phone) combined with a biometric (fingerprint, face scan) or PIN. This eliminates credential stuffing, phishing, and database breach risks associated with passwords. For example, a user can log into a service by simply inserting a YubiKey and touching it.

At its core, WebAuthn uses asymmetric cryptography. During registration, the authenticator generates a unique public-private key pair for each website (relying party). The private key never leaves the secure hardware of the authenticator, while the public key is sent to the server. For authentication, the server sends a cryptographic challenge; the authenticator signs it with the private key, and the server verifies the signature with the stored public key.

WebAuthn credentials are scoped to a specific origin (e.g., https://bank.example.com). An authenticator will not sign a challenge from a phishing site (https://b4nk-example.com) because the origin does not match. This cryptographic binding to the site's domain makes stolen credentials useless on fake sites, providing a fundamental defense against phishing attacks that target passwords and OTP codes.

WebAuthn supports a range of authenticators, classified by their attachment and verification methods:

• Platform Authenticators: Integrated into the user's device (e.g., Touch ID on macOS, Windows Hello, Android fingerprint sensor).
• Cross-Platform (Roaming) Authenticators: Portable hardware tokens that connect via USB, NFC, or Bluetooth (e.g., YubiKey, Google Titan Key).
• Verification methods include user presence (a button press) and user verification (biometric or PIN).

Attestation is an optional process where the authenticator provides a cryptographically signed statement about its make and model (e.g., "YubiKey 5 Series") during registration. This allows enterprises to enforce authenticator policy, restricting login to specific, trusted hardware. For example, a company can mandate that only FIDO2-certified security keys from an approved vendor list can be used to access corporate systems.

A resident key (or discoverable credential) is a private key stored persistently on the authenticator, along with user information like a user handle. This enables a usernameless authentication flow: the user simply plugs in their key, and the site presents a list of accounts associated with that key. The user selects their account and verifies with a biometric, completing login without typing a username or password.

Public key cryptography (or asymmetric cryptography) is the cryptographic foundation of WebAuthn. It uses a mathematically linked key pair: a private key (kept secret) and a public key (shared openly).

• During registration, a new key pair is generated by the authenticator. The public key is sent to the relying party (the website), while the private key never leaves the secure authenticator.
• During authentication, the relying party sends a challenge. The authenticator signs this challenge with the private key, and the relying party verifies the signature using the stored public key.
• This eliminates shared secrets (like passwords) and enables strong cryptographic proof of identity.

Multi-Factor Authentication is a security mechanism that requires a user to present two or more distinct verification factors. WebAuthn authenticators can satisfy multiple factors in a single gesture.

• Knowledge Factor: Something you know (e.g., a PIN or password to unlock the authenticator).
• Possession Factor: Something you have (e.g., the physical security key or registered device).
• Inherence Factor: Something you are (e.g., a biometric like a fingerprint or face scan).
• A WebAuthn login using a device PIN + biometric scan is a two-factor authentication (2FA) process, combining possession and inherence.

In the WebAuthn specification, the Relying Party is the entity that registers and authenticates users—typically, the web application or service (e.g., example.com). Its responsibilities include:

• Registration: Requesting the creation of a new public key credential, storing the public key and credential ID, and associating them with a user account.
• Authentication: Requesting an assertion (signature) from an existing credential to verify a user's identity.
• Policy Enforcement: Defining acceptable authenticator types (e.g., platform vs. cross-platform) and requiring user verification (PIN/biometric).

An Authenticator is the hardware or software component that creates and stores the private key and performs the cryptographic operations for WebAuthn. There are two primary types:

• Platform Authenticator: Integrated into a user's device (e.g., Touch ID on Mac, Windows Hello, Android device biometrics).
• Cross-Platform (Roaming) Authenticator: A removable device that works across multiple platforms (e.g., a YubiKey, Google Titan Key).
• Authentators contain a secure element or Trusted Execution Environment (TEE) to protect private keys from extraction, even if the host operating system is compromised.