Thursday, March 7, 2019

WebAuthn

WebAuthn -Web Authentication

Abstract 


This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given WebAuthn Relying Party, are created by and bound to authenticators as requested by the web application. The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to Relying Parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.

About WebAuthn

For More Reference - duo.com
WebAuthn is a browser-based API that allows for web applications to create strong, public key-based credentials for the purpose of user authentication. It was officially ratified by the W3C (World Wide Web Consortium) in April of this year, and we’ve seen tremendous movement and support by major browsers ever since. Mozilla Firefox was first with support for WebAuthn and Google added Chrome support just last month. Microsoft’s Edge browser is also expected to add support later this year.

Immediately, WebAuthn can be used to support Universal Second Factor (U2F) security keys. However, as laptops with biometric authenticators become increasingly ubiquitous in enterprise environments, it will be used primarily for biometric authentication.

How does WebAuthn Work?


WebAuthn is an API that makes it very easy for a relying party, such as a web service, to integrate strong authentication into applications using support built in to all leading browsers and platforms. This means that web services can now easily offer their users strong authentication with a choice of authenticators such as security keys or built-in platform authenticators such as biometric readers.

How WebAuthn Works?

  • User registers to a web service
  • User chooses an authenticator
  • User authenticates to the web service
  • Rapid recovery from lost/stolen device


The Security Key by Yubico does not require any additional software or drivers to use. It contains no batteries and will work in Chrome with any website or application that supports the U2F specification. The device is incredibly robust in normal use, and even some abnormal use.

Yubico is a board level member of the FIDO alliance leading the specification development of U2F; our devices are the reference authenticators for the U2F standard. 
Yubico's FIDO U2F Security Key is a hardware authenticator with secure element supporting the Universal Second Factor (U2F) standard co-invented by Yubico and now hosted by the FIDO Alliance. It allows users to authenticate to all their U2F-enabled services and applications with one device. The Security Key by Yubico employs a secure element used to generate secrets and securely store them. The U2F protocol specifies that a new key pair is generated by the authenticator for each service, with the public key shared with that service and the private key only available to the Security Key's secure element. The authenticator provides no identifiable data to the service provider, maintaining your privacy between services.



  • Prevents unauthorized access by requiring the physical presence of the key to log in on that device
  • Lug it in and touch the gold button or edge
  • No codes to type or apps to install
  • Use it on Microsoft Windows, mac os x, Linux, and chrome os for Chromebooks
  • Fits nicely on a keychain, in a wallet, or inside a USB port Crushproof and water-resistant, no batteries or moving parts
 Two-factor authentication (2FA) is also referred to as two-step verification (2SV). It adds an extra layer of security to your account that you, and only you, can access in order to prove your identity. Millions of people use YubiKeys for 2FA because they're the easiest to use, super secure. Plug in your YubiKey and tap it to log in to your computers, networks, and online services. Keep one on your keychain with the key to your house/car, and a second YubiKey in a safe place as a backup.

Download WebAuthn:
https://www.w3.org/2018/Talks/06-WebAuthn.pdf

Reference:
https://www.w3.org/TR/2019/REC-webauthn-1-20190304/
https://www.yubico.com/webauthn/

Buy Now Amazon

on

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)