In the previous post I went over a live demonstration showing how a passkey can be used for replication of a credential comprising a JSON certificate and its associated private key across browser instances on different devices controlled by the same user.
Here I propose a new method, not yet implemented, of using a passkey to make such a credential available on multiple devices. In this method the credential is issued to the user's sync fabric as a whole, instead of being replicated across browser instances after being issued to one particular instance. After being issued to the fabric, it is available on any browser instance with full cryptographic protection, instead of being stored in the clear in each instance where it has been replicated. By the user's sync fabric I mean the set of browser instances to which the passkey can be synced. By full cryptographic protection I mean that the certificate is encrypted and the private key is in protected storage such as the TPM used by Windows Hello.
The new method uses the following issuance and presentation protocols.
Continue reading "Making a third-party credential available on multiple devices by issuing it to the user’s sync fabric"