Passkeys through FIDO: How to write your own client?
summary
Walks through building a FIDO2/WebAuthn client end-to-end: Android app requests publicKeyCredentialCreationOptions from a server, negotiates transport (USB/NFC/BLE), prompts for PIN to unlock a hardware token, sends CBOR encoding frames of CTAP commands to create credentials, and returns the authenticator’s public key and signed challenge for server verification. Covers COSE algorithm identifiers like -7 and -268, chunking and transport quirks, and concludes that reimplementing all this is possible but error-prone—use vetted libraries unless you want to own every low-level detail.
AI-written summary · about
chapters (8)
- 0:00Passkeys and FIDO intro
- 1:09Passwords vs passkeys
- 4:20WebAuthn specification
- 9:11COSE and CBOR in passkeys
- 11:59CTAP explained
- 15:32Passkey implementation flow
- 18:01Implement passkeys manually?
- 20:49Platform authenticators
related talks
56mPasskeys 101: Technical Principles of FIDO
22mPasskeys on Android
47mWhy FIDO Security Keys & Webauthn are Awesome
01h 14mWebAuthn: Theory and practice
42mBeyond Passwords: How WebAuthn Actually Works
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
38mBreaking FIDO: Are Exploits in There?
40mWebAuthn 201: How to FIDO