Intermediate LevelAuthentication & Authorization
How do WebAuthn Registration and Authentication Ceremonies work technically?
❓ Interview Prompt: Explain WebAuthn Registration vs Authentication ceremonies, attestation statements, challenge signing, and CBOR parsing.
W3C WebAuthn specifies two distinct cryptographic ceremonies between the Browser, Authenticator (TouchID/YubiKey), and Relying Party (Server):
1. Registration Ceremony:
1
Server generates a random challenge nonce and user info.
2
Browser calls 'navigator.credentials.create()'.
3
Authenticator generates a new key pair and returns a signed Attestation Object containing the public key.
4
Server verifies attestation signature and stores the public key alongside 'credentialId'.
2. Authentication Ceremony:
1
Server generates a random challenge.
2
Browser calls 'navigator.credentials.get()'.
3
Authenticator signs the challenge using its private key, returning an Assertion Signature.
4
Server verifies assertion signature using the stored public key.
Code Implementation Example
typescript
import { verifyAuthenticationResponse } from '@simplewebauthn/server';
// Server-side verification of WebAuthn authentication assertion
const verification = await verifyAuthenticationResponse({
response: clientWebAuthnResponse,
expectedChallenge: storedSessionChallenge,
expectedOrigin: 'https://app.company.com',
expectedRPID: 'company.com',
authenticator: {
credentialPublicKey: storedPublicKeyBuffer,
credentialID: storedCredentialIdBuffer,
counter: storedSignCounter
}
});
console.log('Passkey Verified:', verification.verified);💡Server-side verification of WebAuthn authentication assertion.
🎯 Interview Key Takeaway
WebAuthn registration creates and stores public keys; authentication verifies server challenges signed by hardware private keys.
#WebAuthn#Passkeys#Attestation#Assertion#Intermediate
Back to all Authentication & Authorization Questions→