4 ms·
I have not heard of this key handle before - is there any docs on it? Oh wait, example.com sends me a encrypted key, that I decrypt and then use? That sounds .
by lifeisstillgood 5y ago
I have not heard of this key handle before - is there any docs on it?
Oh wait, example.com sends me a encrypted key, that I decrypt and then use? That sounds ... odd.
I mean, why not just keep the same encrypted data on my local phone ? The attack surface seems much smaller.
- scott00 5y agoThe U2F spec https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.html https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... has a clear description in the "Allowing for Inexpensive U2F Devices" section. For webauthn, they don't use key handle terminology anymore, but the same fuctionality is provided by the "Credential ID": https://www.w3.org/TR/webauthn-2/#credential-id https://www.w3.org/TR/webauthn-2/#credential-id