Level 3 passkey support

[GitDev245]

Hi guys,
does webauthn4j provide support for passkey?

[ynojima]

What feature do have in your mind by "passkey"?
For sharing credential between multiple devices, it is browsers' feature, not WebAuthn RP servers' one. As long as users' browsers support it, it can be used with webauthn4j library.

[GitDev245]

Hi Ynojima,
Thanks for quick response. I am looking for the Webauthn4J back end server API to tell the browser that it will allow passkeys to authenticate. We want the back end server to send the option (https://w3c.github.io/webauthn/#multi-device-credential and https://w3c.github.io/webauthn/#sctn-credential-backup) to support backup etc as part of registration request where we tell what type of authenticator the backed server supports. I think this needs support in MakeCredentialRequest or PublicKeyCredentialCreationOptions class, but I might not be understanding this correctly.

[ynojima]

As far as I remember, there is no way to request multi-device credentials selectively in WebAuthn API. The RP is able to determine the credential is single-device or multi-device after receiving the credential by checking the BE flag.
WebAuthn4J supports parsing the BE and BS flags:

webauthn4j/webauthn4j-core/src/main/java/com/webauthn4j/data/attestation/authenticator/AuthenticatorData.java

Lines 137 to 143 in e17a0cc

	public boolean isFlagBE() {
	return checkFlagBE(this.flags);
	}
	public boolean isFlagBS() {
	return checkFlagBS(this.flags);
	}

[GitDev245]

Thanks YNojima. This is very helpful.

• So looks like during registration backend server/RP can only request as part of create Credential request limited authenticator selector criteria. This is limited to only selecting Platform or cross platform authenticator
• If backend want to select authenticator to specify/require software/hardware key protection type, it is not possible
• Can you confirm if there is any plan to support WebAuthN Extensions like uvm and devicePubKey?

[ynojima]

So looks like during registration backend server/RP can only request as part of create Credential request limited authenticator selector criteria. This is limited to only selecting Platform or cross platform authenticator

Your understanding is correct.

If backend want to select authenticator to specify/require software/hardware key protection type, it is not possible

No, you can not selectively create a hardware-backed credential. All you can do is to reject it after receiving the created credential.

Can you confirm if there is any plan to support WebAuthN Extensions like uvm and devicePubKey?

uvm extension is already supported: https://github.com/webauthn4j/webauthn4j/blob/master/webauthn4j-core/src/main/java/com/webauthn4j/data/extension/client/UserVerificationMethodExtensionClientOutput.java
When you request it to the browser, WebAuthn4J can parse the response.

devicePubKey is not yet supported, but since the spec is already merged into W3C WebAuthn spec, and I heard Chrome on Android has already implemented it, I'd like to implement it (but there is no concrete schedule).

[GitDev245]

Excited to see that devicePubKey extension is being supported in webauthn4j. It is not clean if we have to reject the registration after the credential is created in authenticator and deal with cleanup. Also WebauthN extensions seem to be optional and authenticators and clients can ignore them. It would have been cleaner if RP can specify their authenticator selection criteria. Since level 3 spec is still in draft, hopefully they might still address this.
Sincere thanks for all your patience in explaining how this works.