Skip to content
mera
Get startedGetting started →

Passkeys and the PRF extension

A passkey is a WebAuthn credential. WebAuthn is the browser standard for signing in with key pairs instead of passwords. A credential is one such key pair, created at a website’s request by an authenticator: a phone, a password manager, or a hardware key. The private key never leaves the authenticator.

Passkeys are bound to a relying party ID. The rpId is a domain, and a credential created under one rpId cannot be used under another.

Passkeys sync. Platform authenticators, the credential stores built into an operating system or a password manager, replicate credentials across a person’s devices: iCloud Keychain across Apple devices, Google Password Manager across Android and Chrome, 1Password wherever it runs.

User verification

Section titled “User verification”

Every mera ceremony requires user verification, the authenticator’s local check that the person is present and is the owner. The gesture depends on the platform: a biometric, a device PIN, a password.

The requirement is not configurable. PRF is built on the hmac-secret primitive of CTAP, the protocol browsers use to talk to authenticators. An authenticator keeps two PRFs per credential, one for user-verified requests and one for the rest. WebAuthn exposes only the user-verified PRF and overrides a weaker userVerification setting when evaluating it.

The PRF extension

Section titled “The PRF extension”

The PRF extension gives each credential a pseudorandom function: a function whose output looks random but is fully determined by its inputs. The caller passes a 32-byte salt with the ceremony and the authenticator returns 32 bytes.

PRF output is determined by the credential, relying party ID, and salt. Those inputs produce the same 32 bytes on every synced device. Salts act as namespaces.

The PRF as a function. The relying party ID and a salt enter the authenticator, where the credential and the PRF live; the PRF returns 32 bytes of output. The same credential, relying party ID, and salt produce the same 32 bytes on every synced device; a different salt produces unrelated output. Relying party ID account.example.com Salt 32 bytes, a namespace authenticator Credential never leaves the authenticator PRF deterministic PRF output 32 bytes, stable The same credential, rpId, and salt produce the same 32 bytes on every synced device. A different salt produces unrelated output: salts are namespaces.

Using the output

Section titled “Using the output”

The output works as key material in two ways. Used as an encryption key, it locks data to the passkey: decrypting takes another ceremony. Used as a derivation seed, it recreates the same keys and accounts on every ceremony, so none of them are stored.

Ceremonies and prompts

Section titled “Ceremonies and prompts”

A ceremony is one WebAuthn call and one user-verification prompt. A ceremony either creates a credential (closest analogy is sign up) or runs an assertion (sign in).

See also

Section titled “See also”