3 ms·

I'd be curious to know why it chooses to have a register step, why not just use the key of the authenticator/the relying ID as a proof of identity? You would n

by totony 8y ago

I'd be curious to know why it chooses to have a register step, why not just use the key of the authenticator/the relying ID as a proof of identity? You would normally use a scheme like this so that websites cannot connect multiple identities together, but it seems pointless here because the pubkey will be signed with the user identity and the server will have logged your real pubkey

deleted 8y ago
[deleted]
emlun 8y ago
No, you were right at the beginning. There is no "root" or "real" pubkey. A separate keypair is generated each site, so that - like you said - identities are unlinkable. This is also a crucial part of what makes these credentials immune to phishing.