[webkit-dev] Request for position: WebAuthn support for credBlob and minimum PIN length

Adam Langley agl at chromium.org
Wed Mar 24 11:43:46 PDT 2021

Dear WebKit folks,

We (Chromium) are fleshing out our support for WebAuthn Level Two
<https://www.w3.org/TR/webauthn/> and CTAP 2.1
corresponding protocol between devices and security keys).

As part of that we're interested in any WebKit opinions about the following:

CTAP 2.1 credBlob extension
 (Intent thread
, platform status entry <https://chromestatus.com/feature/5541178411843584>

This is a bytestring stored by the authenticator, just like the user
handle, but a separate value. Microsoft plan to use it in mixed web/native
contexts to store the hash of some externally-provided information in order
to authenticate it.

(This only involves an IDL change in Chromium due to the way that we
implemented authenticator extensions, it might not need code changes in

Minimum PIN lengths
yet the subject of an Intent to Ship):

This allows enterprises to configure a minimum PIN length greater than the
default value of four. It  also involves an extension
report, to the enterprise, what minimum is in effect. The extension will
involve IDL changes in Chromium for the same reason, and our PIN-related
management UIs would have to be updated to respect the configured minimum.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20210324/fee69e02/attachment.htm>

More information about the webkit-dev mailing list