How WebAuthn works
1. Register User
Create a username and register a WebAuthn credential. The browser generates a private key on the device and submits a public key to the server.
A
Choose username
B
Platform authenticator / security key
C
Store public key and credential
2. Login
On login, the server asks the authenticator to sign a fresh challenge. This proves possession of the private key without sending it to the server.
A
Server creates challenge
B
Browser calls authenticator
C
Signature proves identity
3. Sign Block
The same login credential is used again, but the challenge is now bound to the current block, so the signature also attests to the ledger state.
A
Current block hash included
B
Authenticator signs block-bound challenge
C
Server records block attestation
The key difference
Login
Fresh challenge proves “this user is present right now.”
Sign
Fresh challenge + current block hash proves “this user is present and this is the current ledger state.”
Challenge used
login: random_bytes() sign: SHA512(random + block_hash + block_number + timestamp + rp_id)
Animated flow
Register
→
Login
→
Sign Block