WebAuthn Passkeys with Ed25519

Registration creates the keypair; assertion proves possession by signature

WebAuthn Passkeys with Ed25519 Registration creates the keypair; assertion proves possession by signature begin register challenge create passkey generates Ed25519 keypair attestation + pubkey register server stores public key begin login challenge sign challenge signed assertion assert verified: signature ok Registration Assertion Browser · WebAuthn API · Sequence participant Browser WebAuthn API Authenticator · passkey / TPM · Sequence participant Authenticator passkey / TPM RP Server · Go verifier · Sequence participant RP Server Go verifier Legend request return security async trace

Registration

  • • Server issues a one-time challenge
  • • Authenticator creates an Ed25519 keypair
  • • Only the public key ever leaves the device

Assertion

  • • Each login uses a fresh challenge
  • • The private key signs; it never moves
  • • Server verifies with the stored public key

Why It Holds

  • • No shared secret to phish or leak
  • • Signatures are bound to the origin
  • • Replay is blocked by per-login challenges

Sequence diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export