What question did this study set out to answer?

This research aims to develop a browser-based system for creating verifiable presentations without server dependencies.

April 4, 20260 citationsOpen Access

Client-Side Verifiable Presentation System with Passkey-Derived Persistent Keys and Pairwise Service Bindings

Key Points

This research aims to develop a browser-based system for creating verifiable presentations without server dependencies.
Developed a client-side presentation system that operates entirely in the browser.
Employed a passkey-derived strategy with WebAuthn PRF for deterministic key generation.
Utilized non-extractable Web Crypto API keys for device-bound cryptographic security.
Implemented pairwise service binding to prevent cross-service profile linkage.
Enabled selective disclosure and authenticator change detection.
Successful browser-based generation of verifiable presentations without server round-trips.
Deterministic key recovery was achieved across devices without central key escrow.
Privacy preserved through pairwise service bindings and selective information sharing.
Implemented a mechanism for detecting changes in authenticators using public key hashes.

Abstract

This paper describes a client-side system for creating Verifiable Presentations (VPs) entirely within a web browser, without server round-trips during presentation generation. The system employs two key derivation strategies: (A) a passkey-derived strategy using the WebAuthn PRF extension to derive deterministic cryptographic keys, and (B) a device-bound strategy using non-extractable Web Crypto API keys with OPAQUE session key-based wrapping. Both strategies produce pairwise per-service binding identifiers, preventing cross-service profile linkage. Novelty claims disclosed: (1) Browser-based offline VP generation using WebAuthn PRF, (2) Deterministic cross-device key recovery without central key escrow, (3) Pairwise service binding for privacy, (4) Selective disclosure within the VP payload, (5) Authenticator change detection via public key hash, and (6) OPAQUE session export keys as a device recovery mechanism.

AIに質問

Bookmark

View Full Paper