Passkey tokens features

How to test

To ensure a successful test of the authenticator, please follow these steps:

1. Prepare the authenticator that you wish to test. It is recommended to use it only for this test to avoid any conflicts. If necessary, delete the passkey and reset the authenticator's settings (e.g., disable PIN).
2. Open https://webauthntest.identitystandards.io/. Be prepared to capture screenshots of each system/browser dialogue that appears. Register multiple times using all the different values mentioned below (randomise combinations at will, or prepare several strict scenarios that ensure coverage?!). Save the parameters used and the corresponding results for each registration.
3. Click the "..." button and record the diagnostic results (when, where, how to record?).
4. Click the "+" button to create a passkey. Choose the following values:
   1. RP Info: This domain
   2. User Info: Bob
   3. Attachment: undefined
   4. Require Resident Key: true
   5. Resident Key (L2): required
5. Try out the following combinations:
   1. User Verification: Discouraged/Required (the result should be identical)
6. Leave User Verification: Required and try out these:
   1. Attestation: Enterprise/Direct/Indirect/None (or Undefined if nothing else works)
7. Leave Attestation: None and try out these:
   1. CredProtect Extension: userVerificationOptional/userVerificationOptionalWithCredentialIDList/userVerificationRequired (or Undefined if nothing else works)
8. Reset CredProtect Extension to Undefined and try out the encryption algorithms by unchecking all checkboxes (Use ES256, Use ES384, Use ES512, Use RS256, Use EdDSA). Repeat the registration for each algorithm, selecting one algorithm at a time.

What about using custom environments, such as those with password managers supporting passkeys? Use only vanilla ones?

It is not mentioned how the authenticator should be set up above (UV). Can it be an option on the different platforms besides Yubikey?

If you encounter an error message like "Authenticator data cannot be parsed", it indicates that the combination of arguments used is not supported by the authenticator being tested.

Fill in the detailed results in the following template (perhaps it is better to pre-define the authenticator setup and choices to be made and then provide clear placeholders for entering outcomes and outputs):

Add a comment to the page with the completed table filled out. The results will be aggregated into the summarised table below.

What about trying or at least screenshotting platform-specific passkey options that might be offered during registration? Is there anything else we are interested in? E.g., if several user identities (existing on the device) are selectable here, per passkey single device use of a passkey (i.e. forbidding passkey syncing by user), user notes about passkey...?

Are we interested in the platform's general options, like those on the last screen here?

I guess that we won't be testing sign-in features supported by the platform, as these may easily change and others will be testing them anyway!?

Summarised results