search

w3c / webauthn

Web Authentication: An API for accessing Public Key Credentials
https://w3c.github.io/webauthn/
Other
1.18k stars 171 forks source link

need description & illustrations of overall flow: authnr <--> platform API <--> RP #24

Closed equalsJeffH closed 6 years ago

equalsJeffH commented 8 years ago

Originally submitted by: equalsJeffH, on: Tuesday Oct 06, 2015 at 18:42 GMT

The fido-2 specs so far lack a cohesive exposition of the overall flow: authnr <--> platform API <--> RP

the fido-u2f-raw-message-formats spec covers this in its section 1 Introducion, and has figure 1 illustrating it. Similar discussion and illustrations are in fido-uaf-protocol --- I suggest we have a similar exposition and figure(s) in the fido-2 specs that are slated for W3C submission.

I also note that I was asked about this by a smart person who was looking at the fido-2 specs and couldn't figure out "where the protocol is"

equalsJeffH commented 8 years ago

Original poster: levangongPayPal, on: Tuesday Oct 06, 2015 at 18:51 GMT

Does the attached diagram fill that need? I've updated it to reflect latest spec but people should validate it.

Fido 2.0 API - flow - latest.pdf

equalsJeffH commented 8 years ago

Original poster: selfissued, on: Tuesday Oct 06, 2015 at 20:21 GMT

GitHub is giving me a 404 error when I try to access this link – even though I’m logged in to GitHub.

From: levangongPayPal [mailto:notifications@github.com] Sent: Tuesday, October 06, 2015 11:52 AM To: fido-alliance/fido-2-specs Subject: Re: [fido-2-specs] need description & illustrations of overall flow: authnr <--> platform API <--> RP (#150)

Does the attached diagram fill that need? I've updated it to reflect latest spec but people should validate it.

Fido 2.0 API - flow - latest.pdfhttps://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fgithub.com%2ffido-alliance%2ffido-2-specs%2ffiles%2f8761%2fFido.2.0.API.-.flow.-.latest.pdf&data=01%7c01%7cmichael.jones%40microsoft.com%7c9b16b568abfd4fa404e608d2ce7f2e05%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=GAJicypWYAC9zt99dty0ZZpVuVxoIAKVjB1d6EQWD2U%3d

— Reply to this email directly or view it on GitHubhttps://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fgithub.com%2ffido-alliance%2ffido-2-specs%2fissues%2f150%23issuecomment-145963493&data=01%7c01%7cmichael.jones%40microsoft.com%7c9b16b568abfd4fa404e608d2ce7f2e05%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=4LgmWtSBTOYimiRHrBpz2enPj%2fPLRFHC%2fMwaEULV0Ho%3d.

equalsJeffH commented 8 years ago

Original poster: levangongPayPal, on: Tuesday Oct 06, 2015 at 20:25 GMT

huh, you’re right. For some reasons, it seems it did not take the diagram. Here it is as an attachment.

Thanks, Hubert

nadalin commented 7 years ago

@equalsJeffH can this be closed now ?

equalsJeffH commented 7 years ago

No, this should remain open, i argue that having such protocol diagrams are important for folks to be able to figure out what is going on in this spec. I have digrams in progress, need to be updated (it is on the stack):

https://docs.google.com/presentation/d/1om__oSew4n48MK_Qcc8deq6hCZ6720-Zvv1PdK0CrjA/edit#slide=id.g2b7fa0712_0127

https://docs.google.com/presentation/d/1om__oSew4n48MK_Qcc8deq6hCZ6720-Zvv1PdK0CrjA/edit#slide=id.g2b7fa0712_0158

AngeloKai commented 7 years ago

I agree this should be open. Such diagrams would be really helpful. I do wonder whether this is necessary to be resolved before CR. Browser vendors often look at CR as signal for making the implementation on by default. If the issue is truly about helping people understand the spec, we can wait until CR is announced and a lot more people start coming in to review. This way we will know which diagram is more helpful and make tweaks in an effective manner. @equalsJeffH @nadalin

equalsJeffH commented 6 years ago

I have (finally) begun working on updating these figures -- please see the updated Registration slide

equalsJeffH commented 6 years ago

perhaps this figure https://mdn.mozillademos.org/files/15801/MDN%20Webauthn%20Registration%20(r3).png is a reasonable alternative? where is the source for it I wonder?

equalsJeffH commented 6 years ago

@apowers313 appears to be the main person behind https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API which features figures ( reg and authn ) that are arguably in a more "approachable" style than the "crypto-flow-style" ones I've been working on.

they would need some work (eg alter color scheme?) and double-checking to ensure they denote the appropriate protocol components

WDYT?

apowers313 commented 6 years ago

Here's the recolored images exported as SVG (the originals were OmniGraffle):

WebAuthn Flow - Registration.zip WebAuthn Flow - Authentication.zip

Let me know if they need any fixing up.

equalsJeffH commented 6 years ago

@apowers313 - THANKS

see PR #1007