1. Windows Hello in Microsoft Edge
Anoosh Saboori
Senior Program Manager

2. Microsoft Passport & Windows Hello A multi-factor authentication system built for you and your users
Achieve higher levels of security while reducing costs
Increase user convenience with simple unlock gestures

3. Integrate Microsoft Passport & Windows Hello
Windows 10 apps
Enterprise content
Edge-friendly websites X

4. Windows Hello in Microsoft Edge - Demo
Microsoft Build 2016
11/14/2018 3:54 PM
Windows Hello in Microsoft Edge - Demo
Anoosh Saboori
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Best-in-class security standards should not be kept secret
Microsoft has contributed this technology to the Fast Identity Online (FIDO) Alliance

6. Integrate Microsoft Passport & Windows Hello
Edge-friendly websites X
Windows Hello

7. Coming soon: Integrate FIDO Devices
Edge-friendly websites X
FIDO Devices

8. API overview interface MSCredentials {
11/14/2018 3:54 PM
API overview
interface MSCredentials {
        Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
        Promise<MSAssertion> getAssertion(DOMString challenge, optional MSCredentialFilter filter, optional MSSignatureParameters params);
    };
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Code Walkthrough makeCredential
11/14/2018 3:54 PM
Code Walkthrough makeCredential
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
interface MSAssertion {
        readonly attribute MSCredentialType type;
        readonly attribute DOMString id; //Used as key identifier
    };
    enum MSCredentialType {
        "FIDO_2_0"

11. Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
interface MSFIDOCredentialAssertion : MSAssertion {
  readonly attribute AlgorithmIdentifier algorithm; // RSASSA-PKCS1-v1_5
  readonly attribute DOMString publicKey; //JSON WebKey
  readonly attribute MSAttestationStatement? //Returns NULL
  readonly attribute sequence<MSTransportType> transportHints; //Always return Embedded
    };
    enum MSTransportType {
        "Embedded",
        "USB",
        "NFC",
        "BT"

12. Microsoft Build 2016
11/14/2018 3:54 PM
Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
dictionary MSAccountInfo {
 required DOMString rpDisplayName; //ignored
 required DOMString userDisplayName; //ignored
 DOMString accountName; //ignored
 DOMString userId; //Used as key identifier
 DOMString accountImageUri; //ignored
    };
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
    dictionary MSFIDOCredentialParameters : MSCredentialParameters {
  AlgorithmIdentifier algorithm;  //Set to RSASSA-PKCS1-v1_5
  sequence<AAGUID> authenticators; //ignored
    };
    typedef DOMString AAGUID;

14. Promise<MSAssertion> makeCredential(MSAccountInfo accountInfo, sequence<MSCredentialParameters> params, optional DOMString challenge);
   

15. Code Walkthrough getAssertion
11/14/2018 3:54 PM
Code Walkthrough getAssertion
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Promise<MSAssertion> getAssertion(DOMString challenge, optional MSCredentialFilter filter, optional MSSignatureParameters params);
    dictionary MSCredentialFilter {
        sequence<MSCredentialSpec> accept; //Acceptable list of credential type
    };
    dictionary MSCredentialSpec {
        required MSCredentialType type; //Set to "FIDO_2_0"
        DOMString id;

17. Promise<MSAssertion> getAssertion(DOMString challenge, optional MSCredentialFilter filter, optional MSSignatureParameters params);
    dictionary MSSignatureParameters {
        DOMString userPrompt;
    };

18. Promise<MSAssertion> getAssertion(DOMString challenge, optional MSCredentialFilter filter, optional MSSignatureParameters params);
interface MSFIDOSignatureAssertion : MSAssertion {
  readonly attribute MSFIDOSignature signature;
    };
 interface MSFIDOSignature {
        readonly attribute DOMString clientData; //UTF JSON Encoded of
//{
//  Challenge: <>,
// User Prompt: <>,
//}
        readonly attribute DOMString authnrData //set to
        readonly attribute DOMString signature; // UTF8 encoding of signature over // (authnrData|| SHA-2 Hash of // clientData)

19. API overview MakeCredential GetAssertion
11/14/2018 3:54 PM
API overview
MakeCredential
If the same id is used for makecredential, keys get overwritten
Get public key out of assertion data structure
Insert public key and id to index DB for later usage
Recommendation: store the id on server side to protect against cookies deleted
GetAssertion
Needs a challenge
Assertion.signature goes to server
Support for contextual string
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Other related items No delete API
11/14/2018 3:54 PM
Other related items
No delete API
Use PIN reset
No support for attestation Support coming once W3C specs are settled down
Key isolation
Key isolation exists between modern apps and browser
also origin based isolation based on TLD
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Call to Action
Experiment and prototype with these APIs and give us feedback
Visit for more information
W3C submission links:

22. 11/14/2018 3:54 PM
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.