Opaque, Interoperable Passkey Records (and a Go API)

cadamsdotcom

Ok so we are achieving interoperability by turning passkeys into strings. You know what it's called when you store a secret string in your password manager? A password.

deathanatos

From the linked spec, > The authenticator data is a CBOR structure defined in the WebAuthn Level 3 specification, is returned by the getAuthenticatorData() method of the AuthenticatorAttestationResponse From TFA, > The payload is the authenticator data, a CTAP2 CBOR encoding of most of the credential record fields that is already specified by WebAuthn Both link to the same section of the WebAuthn spec, §6.1 Authenticator Data[1]. Unless I'm missing something, that section is describing a custom binary format, not a CBOR encoding of data. (Though n.b. that one of the items contained by the outer custom binary format is CBOR, but the 37(ish) byte array itself is not CBOR.) (…and it's stuff like that that just makes all of WebAuthn so impenetrable.) [1]: https://www.w3.org/TR/webauthn-3/#sctn-authenticator-data