Technical Report on a Virtual CTAP2 WebAuthn Authenticator

TL;DR

This paper introduces a virtual WebAuthn authenticator that enables secure passwordless authentication without physical hardware keys, supporting TPM integration and serving as an open source platform for standards understanding.

Contribution

It presents a novel virtual authenticator that facilitates secure software-based WebAuthn authentication and supports TPM, reducing reliance on external hardware keys.

Findings

Provides a functional virtual WebAuthn authenticator

Supports TPM-based key generation

Offers an open source platform for standards exploration

Abstract

Even though passwordless authentication to online accounts offers greater security and protection from attack, passwords remain prevalent. Passwordless authentication adoption is impacted by the slow adoption of external hardware keys required to generate the security keys within the authentication protocol. We have developed a virtual WebAuthn authenticator in order to provide an extensible open source platform for understanding the associated standards of WebAuthn and CTAP2. Our authenticator provides secure software authentication for devices that do not have access to a physical hardware interface. Our authenticator also provides an alternative to an external physical hardware key and supports the use of a trusted platform module (TPM) on a device to generate the security keys within a WebAuthn protocol.