Since the very beginning of the Web, browsers have stored SSL certificates, now called TLS certificates. But a technique for storing general purpose cryptographic credentials did not emerge until a presentation at ICMC 2017, after the technique was enabled by the introduction of the Service Worker API, which made it possible to use a service worker for credential presentation.
Service workers enable web apps to work while the browser is offline by intercepting requests for online resources and responding to them with cached data. We repurpose a service worker for credential presentation by using it to intercept a credential request addressed to the issuer by the relying party and responding to it with a credential stored in the browser.
There is an essential difference between how SSL certificates were used in the browser, and the technique for using a browser as a wallet for general purpose credentials proposed at ICMC. SSL certificates were presented at the transport layer, and their storage in the browser was an extension of the browser’s role in their transport layer presentation. By contrast, the ICMC technique for storing credentials in the browser is an application layer technique, and the credentials stored in the browser are presented over the standard application-layer secure channel of the web: HTTPS, i.e. HTTP over TLS with unilateral authentication of the server.
Using a web browser as a wallet for general purpose credentials provides two compelling benefits, for users and for relying parties: every computer user has a browser, and the relying party does not have to figure out where to find the user’s credentials, since the user will reach the relying party using the browser where the user’s credentials are stored, or at least the credential that the user intends to use for authentication to that relying party.
We have used a browser as a wallet in a demonstration of a driver’s license credential using a JSON certificate in full disclosure and selective disclosure formats. The credential was issued to a mobile phone by means of a QR code, then presented to a traffic officer by scanning a QR code and to a website by tapping a registration button.
Registration to a web site is easier on a laptop than on a phone, so we have proposed several methods of presenting a JSON credential to a relying party accessed from a laptop browser:
- In On-demand cross-device replication of a driver’s license credential we have demonstrated two of these methods:
- A method of Cross-Device Credential Replication that makes it possible to issue a JSON credential to a phone browser then replicate it to an instance of the same browser on a laptop for registration to a website.
- A method of credential issuance by email that makes it possible to issue a credential directly to a laptop browser.
- In section 12.4.2.3 of Chapter 12 of an unfinished book on the Foundations of Cryptographic Authentication we have described a protocol that allows a user of a laptop browser to present to a relying party a credential that is stored in a mobile browser.
- We have also proposed a method of Credential Issuance to the Sync Fabric that makes a JSON credential available to the user's entire sync fabric, i.e. to every browser instance controlled by the user.