alfie42

Thanks franga2000! As you rightly mention, this project is focused on authentication, and specifically acting as a client device as per WebAuthn spec [1]. The role of the client device is to marshal requests from apps (such a web browser), to authenticator devices. These could be roaming authenticators like USB/NFC security keys, BLE devices, or a phone app. Optionally, the client device can provide access to a platform authenticator -- as one of the options.

I agree a platform key store would be great to have, and in fact would be a great choice as a backend for the platform authenticator.

This is not dissimilar from how Android apps can interact with the platform's KeyStore API [1], or the Fido2ApiClient [2] for FIDO authentication. When interacting with the FIDO APIs, apps cannot manage their own keys. However, they can interact with all authenticators, including the platform authenticator, backed by the KeyStore.

I do not believe that FIDO2/WebAuthn can be generalised to a crypto API (happy to chat further about this). Rather, we need two separate APIs - like KeyStore and Fido2ApiClient on Android, and Windows' CryptoAPI and WebAuthn.

> There are a few mentions of "platform authenticators", but do we even have such a thing on Linux?

FIDO2 platform authenticators require a Trusted Platform Module (as well as a user verification mechanism). Until we have a generic crypto API which can be restricted to using TPM as its backend, I believe we can use one of the interfaces from the TPM2 software stack (TSS) [4].

[1] https://www.w3.org/TR/webauthn/#client-device [2] https://developer.android.com/training/articles/keystore [3] https://developers.google.com/android/reference/com/google/a... [4] https://github.com/tpm2-software