A Portable Passkey Record Format and Go API Proposal
A proposed portable string format for WebAuthn passkey records, plus a stateless Go API draft, aiming to simplify interoperable credential storage.
WebAuthn defines credential records as an abstract concept, but leaves server-side storage format up to implementers. Guidance from Google and Adam Langley's Tour of WebAuthn each suggest different table schemas, leaving applications with non-interoperable database designs. The c2sp.org/passkey-record proposal borrows Password Hashing Competition string syntax and reuses the existing authenticator data CBOR encoding to treat passkey records as opaque strings, much like password hashes.
Under this model, applications only need to track which passkey records belong to a user account, while the actual WebAuthn verification logic stays with a library. This means teams could swap passkey libraries or even backend languages while keeping their credentials database intact. Building on this record format, a stateless crypto/passkey Go package API was drafted and shared for feedback, ahead of a potential proposal for Go 1.28.
The piece also makes a sharp security point: skipping a primary-key index on Credential ID entirely eliminates a class of collision attacks where an attacker injects a colliding credential ID to hijack lookups — since login attempts already carry the user ID, verification only needs to check against that user's own records.