WebAuthn PRF spike
Does a passkey on this device yield a stable secret? The whole
encryption design depends on it. Nothing here talks to a server — the ceremony
runs entirely in the browser against a throwaway credential.
1 · Environment
2 · Register a test passkey
Creates a discoverable credential for enabled here but only
return actual bytes at authentication — that is expected, not a failure.
Register test passkey
Forget stored handle
—
3 · Derive the secret (run at least twice)
Authenticates and evaluates PRF against a fixed salt. Displays the
SHA-256 of the output , never the secret itself — enough to prove
stability without putting key material on screen.
Derive secret
Clear results
—
4 · Verdict
Run step 2, then step 3 at least twice.
Cross-device check: if this page is served from a real HTTPS
origin (not localhost) and the passkey syncs via iCloud Keychain or Google
Password Manager, run step 3 on a second device. A matching digest there is
the result that matters most — it decides whether one enrolment covers all her
devices or each needs its own wrapped key.