Authnr selection aaguidlist #479

rlin1 · 2017-05-29T12:40:32Z

Close #478

Preview | Diff

…onCriteria. See #441

… from extensions!

rlin1 · 2017-05-29T12:49:01Z

The big PR 442 was split into smaller PRs. This is the one addressing aaguidList

jyasskin

This was defined as an extension. What has changed to start mandating it for all implementations?

Also, why is the AAGUID the right thing to filter on rather than something like a certificate in the attestation chain?

jyasskin · 2017-05-30T05:40:51Z

index.bs

@@ -1067,8 +1068,21 @@ associated.
    ::  This member describes the [=[RPS]=]' requirements regarding availability of the [=Client-side-resident Credential 
        Private Key=]. If the parameter is set to true, the authenticator MUST create a 
        [=Client-side-resident Credential Private Key=] when creating a [=public key credential=].
+
+    :   <dfn>aaguidList</dfn>
+    ::  If this member is [=present|present=], eligible authenticators are filtered to the ones identified by matching


AAGUID filtering needs to happen as a step in https://w3c.github.io/webauthn/#op-make-cred or https://w3c.github.io/webauthn/#createCredential depending on whether the Client or Authenticator has the relevant information, not in the definition of the dictionary field.

rlin1 · 2017-05-30T10:19:32Z

What has changed to start mandating it for all implementations?
In the beginning of the WebAuthn spec process, some people were convinced that RPs wouldn't have the need to influence the authenticator selection.

At this stage, we already have seen that there is a need to the RP to influence the authenticator selection in order to improve the user experience. As a consequence we have been adding the AuthenticatorSelectionCriteria object to the core specification.

The discussion regarding the fields in AuthenticatorSelectionCriteria shows that it is difficult to determine now what the right criteria for authenticator selection will be in the future.

So in my opinion there is substantial value for one generic method allowing the RP to formulate any rule for influencing the authenticator selection.
More specifically, I am convinced that the ability for providing a list of authenticator model names (i.e. AAGUIDs) provides exactly that. It allows the RP to use whatever set of criteria they want on the server side to generate such (prioritized) list and then make it easy for the platform to follow that list.

Also, why is the AAGUID the right thing to filter on rather than something like a certificate in the attestation chain?

The AAGUID was introduced as an abstraction for the authenticator model name. I think it is less bulky to send over a (potentially large) list of AAGUIDs than sending over a (potentially) even larger list of acceptable attestation certificates.
Note: One authenticator model might even have several attestation certificates in use (for the various batches of authenticator instances of such model).

leshi · 2017-05-31T17:22:50Z

index.bs

@@ -598,6 +598,8 @@ When this method is invoked, the user agent MUST execute the following algorithm
        to |authenticator|'s attachment modality, [=iteration/continue=].
    1. If {{AuthenticatorSelectionCriteria/requireResidentKey}} is set to |true| and the |authenticator| 
        is not capable of storing a [=Client-Side-Resident Credential Private Key=], [=iteration/continue=].
+    1. If {{AuthenticatorSelectionCriteria/aaguidList}} is [=present|present=] and the
+        to |authenticator|'s AAGUID protection method is not included in that list, [=iteration/continue=].


what's a "AAGUID protection method"?

Copy&paste error. Corrected that

balfanz · 2017-05-31T17:29:49Z

Can someone explain how AAGUIDs are used today? I personally am not aware of any authenticators that use AAGUIDs, so I would be inclined to not include this functionality in the spec.

But I do think such authenticators exist. Can @rlin1 or someone else explain how this functionality would be used? What could you do that you can't do without this PR, and why is that important?

rlin1 · 2017-05-31T17:42:59Z

TODO: add reference to FIDO Metadata Service as an example on where/how to get information on authenticator models.

…ionCriteria

rlin1 · 2017-06-14T17:33:13Z

Response to #479 (comment):

I am not aware of any webauthn authenticators today. I am aware of UAF and U2F authenticators.
UAF authenticators use a slightly different notion of a "model name" called AAID - and they implement that.
In U2F there is no equivalent of a model name, the closest thing to it is the list of attestationCertificateKeyIdentifiers.

In UAF the RP is able to influence Authenticator selection for "makeCredential" based on the AAID (and other criteria). The authenticator selection-based AAID can be used to support arbitrary criteria to be implemented by the RP - even without requiring dedicated support for that in the API.
For example: the RP could select an authenticator for registration that meets some specific security certification, etc.

I don't know how the RP could do that in U2F or in WebAuthentication - without this aaguidList approach.

nadalin · 2017-06-22T21:39:43Z

Please update this by 6/27 so we can discuss on 6/28 call

rlin1 · 2017-08-28T16:58:43Z

changes requested by @leshi have been addressed.

equalsJeffH · 2017-12-06T21:54:10Z

please merge-from-master (into this branch) and fix build errors, to facilitate further reviews, thx.

equalsJeffH · 2017-12-15T21:14:33Z

I merged-from-master and fixed conflicts.

equalsJeffH

Overall this seems fine to me, we already state in #authenticator-model that "Each authenticator has an AAGUID...". As specified here, using the AAGUID for authnr selection is optional. And it could be helpful for enterprise use cases.

A meta-level question is whether having an AAGUID is mandatory for webauthn authnrs. The above-quoted statement does not use RFC2119 language. We could punt to FIDO Authnr Certification requirements, and not stipulate whether AAGUID is mandatory-to-impl here in the webauthn spec.

Given our discussions concerning what became #attestation-convey, and its defaulting to "none", consumer-space RPs will not be able to rely on knowing users' authnrs' AAGUIDs.

So whether or not AAGUIDs are actually MTI for authnrs, many RPs will not receive them, i.e., they are optionally available to RPs in any case. That ought to be made clear whether or not we decide to accept this PR, because AAGUID-based selection is presently a defined extension.

akshayku · 2017-12-20T21:17:37Z

Overall, this PR looks fine to me but this is breaking WD07 which we all agreed was feature complete and probably not needed. Correct me if I am wrong here.

There are two kinds of RPs, one who care about particular authenticators (for whatever reason, legal or otherwise and I don't want to rehash that discussion) and ones who don't care. Both of these can be addressed by current spec via direct attestation or null attestation(default case). This PR will short circuit faster (platform deciding earlier instead of RP) but essentially both ways achieve the same thing. If I remember correctly, there are other selection criterias (in addition to AAGUID) also which were pushed to L2 sometime back.

Should we take care of this in L2 or do we need it now?

akshayku · 2017-12-21T05:06:11Z

I also see few more selection criteria (Matcher Protection #447, Key Protection #446, Biometric accuracy #445) that we have moved to L2. I would suggest all new selection criteria PRs/Issues (Like this one, Biometric Criteria #510) to be addressed in L2.

rlin1 · 2018-01-10T18:14:09Z

Decided on call to move to L2.

selfissued

This would be a breaking change - and one that adds no new functionality, as there is already a normative extension to obtain this behavior. As we should avoid breaking changes in L2, this PR should be closed with no action.

nadalin · 2019-03-07T19:33:40Z

Per 03/07/19 F2F Close

rlin1 added 7 commits May 4, 2017 19:23

move AAGUID for selecting authenticator into new AuthenticatorSelecti…

4e2c4db

…onCriteria. See #441

added keyProtection to AuthenticatorSelectionCriteria. See #446

3edde5a

added matcherProtection to AuthenticatorSelectionCriteria. See #447

d73f0ba

resolve auto-merge conflicts

24aaa46

Merge branch 'master' into authnr-sel-addtl-fields

543dad4

resolved auto-merge conflict.

72f82e9

added (only) aaguidList to AuthenticatorSelectionCriteria. Removed it…

a7793ab

… from extensions!

rlin1 requested review from jyasskin, gmandyam and equalsJeffH May 29, 2017 12:41

rlin1 self-assigned this May 29, 2017

removed defs for matcherProtection and keyProtection

926ae3d

jyasskin suggested changes May 30, 2017

View reviewed changes

added eval of aaguidList to steps for create

2680b00

leshi requested changes May 31, 2017

View reviewed changes

wseltzer modified the milestone: WD-06 May 31, 2017

added ref to FIDO Metadata Service. Added def for AuthenticatorSelect…

d5bd5a9

…ionCriteria

equalsJeffH mentioned this pull request Jun 7, 2017

Add acceptable trust anchors to AuthenticatorSelectionCriteria #461

Closed

equalsJeffH added this to the CR milestone Jun 14, 2017

correction

132324b

resolved auto-merge conflicts

78d849e

fixed auto-merge conflicts

38d04c7

resolved auto-merge conflicts

75d7551

equalsJeffH requested review from akshayku, selfissued and jcjones November 20, 2017 20:06

equalsJeffH added subtype:algorithms/WebIDL type:technical labels Nov 20, 2017

equalsJeffH changed the title ~~Authnr sel aaguidlist~~ Authnr selection aaguidlist Nov 20, 2017

merge-from-master & fix conflicts

05abd35

fix aaguid dfn and linking errors

34caca4

equalsJeffH approved these changes Dec 19, 2017

View reviewed changes

nadalin modified the milestones: CR, L2-WD-00 Jan 16, 2018

jcjones removed their request for review November 14, 2018 18:02

selfissued requested changes Feb 5, 2019

View reviewed changes

equalsJeffH modified the milestones: L2-WD-00, L2-WD-01 Feb 13, 2019

nadalin closed this Mar 7, 2019

emlun deleted the authnr-sel-aaguidlist branch June 22, 2022 21:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authnr selection aaguidlist #479

Authnr selection aaguidlist #479

rlin1 commented May 29, 2017 •

edited by pr-preview bot

Loading

rlin1 commented May 29, 2017

jyasskin left a comment

jyasskin May 30, 2017

rlin1 commented May 30, 2017

leshi May 31, 2017

rlin1 Jun 14, 2017

balfanz commented May 31, 2017

rlin1 commented May 31, 2017

rlin1 commented Jun 14, 2017 •

edited by equalsJeffH

Loading

nadalin commented Jun 22, 2017

rlin1 commented Aug 28, 2017

equalsJeffH commented Dec 6, 2017

equalsJeffH commented Dec 15, 2017

equalsJeffH left a comment

akshayku commented Dec 20, 2017

akshayku commented Dec 21, 2017

rlin1 commented Jan 10, 2018

selfissued left a comment

nadalin commented Mar 7, 2019

Authnr selection aaguidlist #479

Authnr selection aaguidlist #479

Conversation

rlin1 commented May 29, 2017 • edited by pr-preview bot Loading

rlin1 commented May 29, 2017

jyasskin left a comment

Choose a reason for hiding this comment

jyasskin May 30, 2017

Choose a reason for hiding this comment

rlin1 commented May 30, 2017

leshi May 31, 2017

Choose a reason for hiding this comment

rlin1 Jun 14, 2017

Choose a reason for hiding this comment

balfanz commented May 31, 2017

rlin1 commented May 31, 2017

rlin1 commented Jun 14, 2017 • edited by equalsJeffH Loading

nadalin commented Jun 22, 2017

rlin1 commented Aug 28, 2017

equalsJeffH commented Dec 6, 2017

equalsJeffH commented Dec 15, 2017

equalsJeffH left a comment

Choose a reason for hiding this comment

akshayku commented Dec 20, 2017

akshayku commented Dec 21, 2017

rlin1 commented Jan 10, 2018

selfissued left a comment

Choose a reason for hiding this comment

nadalin commented Mar 7, 2019

rlin1 commented May 29, 2017 •

edited by pr-preview bot

Loading

rlin1 commented Jun 14, 2017 •

edited by equalsJeffH

Loading