passkeys

Opaque, Interoperable Passkey Records (and a Go API)

2 months ago

Passkeys are critical for phishing resistance, similar to how memory safety addresses memory corruption.
Server-side implementation of passkeys can be complex, but interoperable passkey record encodings can simplify this.
The proposed passkey record format is $webauthn$v=1$transports=<type>$<base64 authenticator data>, reusing existing WebAuthn encodings.
Applications only need to store passkey records per user, similar to managing passwords, with the library handling verification.
The Go API draft uses RelyingParty methods for registration (NewRegistration, Register) and login (NewLogin, Login) flows.
Applications manage opaque user IDs, store passkey records, and cache request challenges, while the library handles JSON parsing.
The proposed model avoids credential ID collision attacks by not using a credential ID index, relying on user ID lookup instead.