Question about network handover in the Passkey CTAP process

Question

Created Aug ’23

Replies 1

Boosts 0

Participants 2

I initiated the Passkey CTAP process after establishing an internet connection on my smartphone (authentication device) using Wi-Fi. Once the client PC and the smartphone established a TCP connection and were in the midst of the CTAP process, I attempted to switch the internet connection to a different Wi-Fi network or transition to mobile data. As a result, I was unable to log in with the Passkey. (There was no observable change on the client PC screen; it did not transition to a success/failure screen, leading me to believe that no packets were transmitted.) I initially thought that performing a network handover after the TCP connection might have caused the connection to be severed, resulting in the absence of packet transmission.

However, I discovered that if I established the authentication device's internet connection using mobile data and then, in the middle of the CTAP process, turned off the mobile data to automatically switch back to Wi-Fi, the Passkey login process succeeded.

What is the reason behind this outcome? Can you explain the technical factors that contribute to this behavior?

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’23

There are three actors in this process (known as the "hybrid" transport in CTAP):

The "authenticator" is the device which knows the passkey, generally a phone.
The "client" is the device you're signing in to, in this case a PC.
The "tunnel service" is a network server that relays messages between the authenticator and client.

Communication between the client and the tunnel service is detailed in the spec. However, the spec states

The protocol between the authenticator and the tunnel service, and details about how the service later contacts the authenticator, are a private detail of the authenticator's implementation.

If a disconnection happened between the client and the tunnel service, it would be subject to standard web socket reconnection rules and the retry implementation of the browser. If it happened between the authenticator and the tunnel service, implementation details of the connection are subject to change and should not be relied on.

0