Passkeys GitHub issue

• • Executive summary
• Server-side Passkey class
  • • Bucket fields
  • • Instance methods
  • • Class methods
  • • Exception classes raised by .verify
  • • Why no vault
• Authenticator-side Passkey class
  • • Bucket fields
  • • Instance methods
  • • Class methods
  • • What's never exposed
• • Required engine primitives
• • Open: packaging

{"vibecode": {
    "doc": "passkeys",
    "role": "implementation sketch for WebAuthn / FIDO2 passkeys in Caspian; assumes the reader knows the protocol and is asking what the class shape, engine primitives, and integration points look like",
    "status": "speculative — not a current implementation target; documented so the design is ready when it becomes one",
    "related": ["index.md (parent security model — vault, protected mode, libsodium memory protection)"],
    "audience": "Caspian implementers"
}}

Executive summary GitHub issue

Two Passkey classes for the two WebAuthn roles:

• Server side (relying party): holds credential metadata in regular bucket fields; verifies assertions via libsodium signature primitives. No vault needed — nothing in the bucket is crypto-secret.
• Authenticator side: holds the private key in the vault; signs through vault.sign gateway operations. Uses the existing vault + protected-mode model (see index.md).

Both are user-space Caspian classes. The only genuinely new engine dependency is a CBOR decoder for COSE_Key parsing and attestation/assertion objects. Everything else (CSPRNG, signature primitives, vault) is already on the roadmap for unrelated reasons.

Server-side Passkey class GitHub issue

Bucket fields GitHub issue

Instance methods GitHub issue

Class methods GitHub issue

Exception classes raised by .verify GitHub issue

Why no vault GitHub issue

Every bucket field is non-secret. Public keys, credential IDs, sign counts, and metadata can live in regular DB columns without protection. The vault and protected-mode machinery aren't engaged on the server side.

Authenticator-side Passkey class GitHub issue

Used when Caspian holds private keys (server-to-server passkey-style auth, hosted passkey provider service, CI/CD signing agent).

Bucket fields GitHub issue

Instance methods GitHub issue

Class methods GitHub issue

What's never exposed GitHub issue

• The private key bytes. No accessor returns them; .sign and .export_attestation are the only operations.
• The vault ID is exposed (as @vault_id) but it's useless without the engine's gateway.

Required engine primitives GitHub issue

The CBOR decoder is the only genuinely new dependency. Options:

• C-binding to an existing library (cn-cbor, tinycbor).
• Pure-Caspian implementation. WebAuthn touches a small subset of CBOR; a focused implementation is feasible.

The lean is a C-binding for performance and correctness (CBOR has subtle edge cases — duplicate keys, integer canonicalization, indefinite-length encodings — and existing libraries have already worked them out).

Open: packaging GitHub issue