New Proposal for Interoperable Passkey Records and Go API Announced

Introduction to the Specification Proposal

The increasing threat of phishing attacks has made passkeys a crucial element in information security. Unlike traditional password systems, passkeys provide enhanced phishing resistance, but their implementation can be complex on the server side due to the need for browser interactions.

Current Guidance and Limitations

Following the WebAuthn specification, various experts suggest different database designs to store credential records. Common recommendations include handling records with a primary key and fields for public keys and backup states. Despite guidance to utilize authentication libraries, non-interoperable database schemas may complicate the process for developers.

Proposal for Interoperable Passkey Records

The proposal from c2sp.org outlines a method for creating interoperable passkey records that abstract the complexity of server-side implementation. This approach leverages familiar structures, allowing web developers to manage passkeys similarly to password authentication.

Technical Details of the Record Structure

The specification defines a record structure in a format resembling PHC Strings, where transport methods are included as parameters. The new format comprises important record fields already defined in the WebAuthn standard, enabling seamless implementation and enhancing interoperability across applications.