Adrian Hope-Bailie adrianhopebailie

WebAuthN + Payment Request = Payment AuthZ

Can we use a combination of Payment Request API and WebAuthN API to get Transaction Confirmation (Dynamic Linking)?

Transaction Confirmation (TxConf) is a feature of FIDO that guarantees to the Relying Party (RP) that the user saw the same transaction details that are signed by their authenticator, i.e. WYSIWYS (What You See Is What You Sign)

Why is transaction confirmation important?

In the absence of TxConf an authenticator can ONLY assert that a challenge (generated by the RP to prevent replays) was signed inside the authenticator at the consent of the user (who provided the neccessary gesture to "unlock" the authenticator, e.g. biometric scan, PIN etc).

Generate a key using the node REPL

Needs JOSE npm lib. Easiest thing to do is just install it in a temp working dir.

cd /tmp
npm i jose
node

Inside the REPL:

	#include <ESP8266WiFi.h>
	#include <WiFiClient.h>
	#include <ESP8266WebServer.h>
	#define SENSOR A0
	#define DIGI_SENSOR D5
	#define PUMPOUT D6

	/* Set these to your desired credentials. */
	const char *ssid = ""; //Enter your WIFI ssid
	const char *password = ""; //Enter your WIFI password