Current Reference Implementation for a Mobile Authenticator

[Michael]

Given all the changes in the past few weeks, does anyone have a link to a current reference implementation for WebAuthn using a mobile authenticor?

I have spent hours searching.  Please help!  :)

[Emanuele Cesena]

Can you clarify what do you mean?

Depending how do you define things, there’s no such thing like a mobile authenticator, meaning that in the context of webauthn the authenticator (i.e. the security key) should be able to directly talk to the browser via usb, nfc or ble. Today you can use an android phone (so a mobile device) as a security key, talking to chrome via ble (though I’m unclear if this is ctap2-ble or a custom protocol).

Again, maybe I’m misled by definitions, but to the best of my knowledge there’s currently no reference implementation of an authenticator.

Best,

On May 11, 2019, at 2:17 PM, Michael <mduf...@gmail.com> wrote:

Given all the changes in the past few weeks, does anyone have a link to a current reference implementation for WebAuthn using a mobile authenticor?

I have spent hours searching.  Please help!  :)

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/ba24b31a-a204-42da-ace9-d72ecc7de547%40fidoalliance.org.

-- 

Emanuele Cesena <e...@solokeys.com>

https://solokeys.com

Il corpo non ha ideali

[James Barclay]

Hi Michael and Emanuele,

If you’re referring to a reference implementation of an Android application that functions as an authenticator, we (Duo Labs) have an Android library for this, which abstracts quite a bit of the WebAuthn authenticator operations and can be used to implement your own authenticator app.

https://github.com/duo-labs/android-webauthn-authenticator

https://duo.com/blog/introducing-the-webauthn-authenticator-open-source-library

Hope this helps.

-- 

James Barclay

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/5702647A-1B01-4D43-8C9B-B3A5C019D3C9%40gmail.com.

[Michael]

Thx.  This is exactly what I am looking for:  "a reference implementation of an Android application that functions as an authenticator".

This is really good information, especially https://webauthn.guide/.

Is there a really good process flow diagram for WebAuth using an Android application as an authenticator?

On Saturday, May 11, 2019 at 4:34:04 PM UTC-5, James Barclay wrote:

Hi Michael and Emanuele,

If you’re referring to a reference implementation of an Android application that functions as an authenticator, we (Duo Labs) have an Android library for this, which abstracts quite a bit of the WebAuthn authenticator operations and can be used to implement your own authenticator app.

https://github.com/duo-labs/android-webauthn-authenticator

https://duo.com/blog/introducing-the-webauthn-authenticator-open-source-library

Hope this helps.

-- 

James Barclay

On May 11, 2019, at 17:28, Emanuele Cesena <emanuel...@gmail.com> wrote:

Can you clarify what do you mean?

Depending how do you define things, there’s no such thing like a mobile authenticator, meaning that in the context of webauthn the authenticator (i.e. the security key) should be able to directly talk to the browser via usb, nfc or ble. Today you can use an android phone (so a mobile device) as a security key, talking to chrome via ble (though I’m unclear if this is ctap2-ble or a custom protocol).

Again, maybe I’m misled by definitions, but to the best of my knowledge there’s currently no reference implementation of an authenticator.

Best,

On May 11, 2019, at 2:17 PM, Michael <mduf...@gmail.com> wrote:

Given all the changes in the past few weeks, does anyone have a link to a current reference implementation for WebAuthn using a mobile authenticor?

I have spent hours searching.  Please help!  :)

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to fido...@fidoalliance.org.

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/ba24b31a-a204-42da-ace9-d72ecc7de547%40fidoalliance.org.

-- 

Emanuele Cesena <e...@solokeys.com>

https://solokeys.com

Il corpo non ha ideali

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to fido...@fidoalliance.org.

[Michael Duffy]

Actually, what I am looking for is a roaming authenticator that is implemented over BLE to an Android smart phone.

https://www.w3.org/TR/webauthn/#roaming-authenticators

Does anyone have a working example?

[Marcus Henriksbø]

Hi, have you found a solution?

[Sravz]

Hi Michael,

Use https://github.com/freeu2f/freeu2f-android as a reference for BLE. 

This is implemented for u2f but BLE implementation might be useful for you. 

[mehak zahra]

Hi Members,

Does anyone here have a link to any demo implemented in android using CTAP2 specifications?

[John Bradley]

I think you need to be clearer on your use case.

Are you looking for a app on Android that uses the Android WebAuthn API, like Firefox and some other apps are doing?

Or are you looking for a way to provide a CTAP2 API over some transport?

The latter you probably wont find as people are waiting for the announced caBLE functionality in Android to be opened up to third parties, rather than just for Google login as it is now.

John B.

--

You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/1e62c7d0-12e7-4376-9a6e-d3efee21ae34%40fidoalliance.org.

[SABIR ALI]

Maybe this is what you're looking for.

https://github.com/kryptco/krypton-android

Although this is for U2F, but might be a good start for someone looking for CTAP2 roaming authenticator.

-Sabir,

[Sravz]

use the below links for the android authenticator implementation:

https://github.com/duo-labs/android-webauthn-authenticator

https://github.com/freeu2f/freeu2f-android

[Tanmay Sawant]

Hi Michael,

Were you able to develop the mobile authenticator? Can you share any insights or useful resources?

Thanks!

[Richard Maher]

Not sure that I understand the question but Tim gave this answer to the How do I use mobile phone over bluetooth question: -

https://stackoverflow.com/questions/73088756/fido2-seamless-sign-in-across-devices-passkeys

--

You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/f6bc28b3-a966-467e-9b8f-e30c7b369041n%40fidoalliance.org.

[Rick]

I'm not sure this applies but I have successfully implemented a FIDO2 authenticator app. The Android build is working well, I think. The Apple build still awaits the BLE interface, a result of a small tiff over eligibility. I'll be finishing that after my current project adding FIDO2 push to the app. The app, AffirmID Auth, is beta test from respective stores. The FIDO2 part of dev was a snap, the BLE part, well not so much. Firebase Push is progressing well with Oct beta date target.