1
# 注册时：生成密钥对
2
key_pair = {
3
    "private_key": "设备本地保存，永不离开",
4
    "public_key": "发送到服务器存储"
5
}
6

7
# 登录时：签名验证
8
challenge = "服务器下发的随机挑战"
9
signature = authenticator.sign(challenge, private_key)

1
// Passkey 是 FIDO2 凭证的统称
2
// 在 iOS 上由 iCloud Keychain 同步
3
// 在 Android 上由 Google Password Manager 同步

1
class AuthService:
2
    async def register(self, user_id, attestation_response):
3
        # 1. 验证 attestation 签名
4
        credential_public_key = verify_attestation(
5
            attestation_response
6
        )
7

8
        # 2. 生成凭证 ID
9
        credential_id = generate_credential_id()
10

11
        # 3. 存储公钥和凭证
12
        await db.credentials.create(
13
            user_id=user_id,
14
            credential_id=credential_id,
15
            public_key=credential_public_key,
16
            counter=0,
17
            device_type="platform"
18
        )

1
const credential = await navigator.credentials.create({
2
  publicKey: {
3
    challenge: new Uint8Array(challenge),
4
    rp: {
5
      name: "My Application",
6
      id: "my-app.com",
7
    },
8
    user: {
9
      id: new Uint8Array(userId),
10
      name: "user@example.com",
11
      displayName: "张三",
12
    },
13
    pubKeyCredParams: [
14
      { alg: -7, type: "public-key" }, // ES256
15
      { alg: -257, type: "public-key" }, // RS256
16
    ],
17
    authenticatorSelection: {
18
      authenticatorAttachment: "platform",
19
      userVerification: "required",
20
    },
21
  },
22
});

1
async def authenticate(self, user_id, assertion):
2
    # 1. 获取用户公钥
3
    credential = await db.credentials.get(
4
        user_id=user_id,
5
        credential_id=assertion.credential_id
6
    )
7

8
    # 2. 构建验证数据
9
    verify_data = build_verify_data(
10
        assertion.challenge,
11
        assertion.authenticator_data,
12
        assertion.client_data
13
    )
14

15
    # 3. 验证签名
16
    if not verify_signature(
17
        credential.public_key,
18
        verify_data,
19
        assertion.signature
20
    ):
21
        raise AuthError("Invalid signature")
22

23
    # 4. 检查计数器（防止克隆）
24
    if assertion.counter <= credential.counter:
25
        raise AuthError("Potential cloned authenticator")
26

27
    # 5. 更新计数器
28
    await db.credentials.update_counter(
29
        credential.id,
30
        assertion.counter
31
    )

1
// 注册新设备
2
async function register(userId, userName, displayName) {
3
  const challenge = await fetch("/api/auth/challenge").then(r =>
4
    r.arrayBuffer()
5
  );
6

7
  const credential = await navigator.credentials.create({
8
    publicKey: {
9
      challenge: new Uint8Array(challenge),
10
      rp: { name: "My App", id: "my-app.com" },
11
      user: {
12
        id: new TextEncoder().encode(userId),
13
        name: userName,
14
        displayName: displayName,
15
      },
16
      pubKeyCredParams: [{ alg: -7, type: "public-key" }],
17
      authenticatorSelection: {
18
        authenticatorAttachment: "platform",
19
        userVerification: "required",
20
      },
21
    },
22
  });
23

24
  await fetch("/api/auth/register", {
25
    method: "POST",
26
    body: credential,
27
  });
28
}

1
// 登录
2
async function login(userId) {
3
  const challenge = await fetch("/api/auth/challenge").then(r =>
4
    r.arrayBuffer()
5
  );
6
  const allowCredentials = await fetch("/api/auth/credentials").then(r =>
7
    r.json()
8
  );
9

10
  const assertion = await navigator.credentials.get({
11
    publicKey: {
12
      challenge: new Uint8Array(challenge),
13
      allowCredentials: allowCredentials.map(c => ({
14
        type: "public-key",
15
        id: new Uint8Array(c.id),
16
      })),
17
      userVerification: "required",
18
    },
19
  });
20

21
  await fetch("/api/auth/login", {
22
    method: "POST",
23
    body: assertion,
24
  });
25
}

1
# rpId 验证防止钓鱼
2
# 如果用户在钓鱼网站调用 WebAuthn
3
# rpId 将是钓鱼网站的域名，无法通过验证
4
def verify_rp_id(rp_id, expected_rp_id):
5
    assert rp_id == expected_rp_id, "RP ID mismatch"

1
# Authenticator 数据结构
2
auth_data = {
3
    "rp_id_hash": "依赖方 ID 哈希",
4
    "flags": {
5
        "user_present": True,      # 用户在场
6
        "user_verified": True,    # 用户已验证
7
        "attested_credential": False,
8
        "extension_data": False
9
    },
10
    "sign_count": 12345,  # 签名计数器
11
    "attested_credential_data": None
12
}

1
# Passkey 同步机制
2
# iOS: iCloud Keychain (端到端加密)
3
# Android: Google Password Manager
4
# Windows: Windows Hello + TPM
5

6
# 服务器无需关心同步细节
7
# 每个设备生成独立密钥对
8
# 用户可注册多个凭证