Search code examples
authenticationwebauthnfidopasskeyweb-authentication-api

Extract/export resident/private key created inside `navigator.credentials.create`?

I want to know if its possible to extract/export the resident/private key created inside navigator.credentials.create?

Please don't ask me what I'm trying to do so you can tell me "well actually, you don't need to do that, you should do this", I'm certain that my requirement in this question is what I need.

Thank you to anyone who engages with this question.

Solution

  • It is not possible with navigator.credentials. It implements WebAuthn which for this can just be seen as an interface towards an authenticator of some type that implements CTAP.

    The authenticator here creates the private/public key through CTAP that is used and as CTAP doesn't expose any way to extract private keys there is nothing within the specification in WebAuthn that would let you extract the key.

    You would need to have control of the authenticator used, be it virtual, physical or passkey based, and then have your own proprietary methods to extract the key.