Webauthn for encryption

Question

We have a project with a PWA where we want to implement client sided encryption. We wanted to use Webauthn as a second-factor in combination with passwords. In the background we use a randomly generated key to encrypt/decrypt the database, which is stored symmetrically encrypted with the password on the server. However I am struggling to find a good way to add encryption to this key with webauthn. My tries so far: Using raw JS samples from https://webauthn.guide , however I cannot find a part which is always the same and could be used for symmetric encryption/decryption, even the public key changes when logging in with the same USB token multiple times (???)

Using fido2-lib from npm: I couldn't get the sample to work, since the sample is not well documented and pretty long

Using server-sided authentication like spring webauthn, however I do not want the server to know anything about the client.

Any suggestions how I could implement an encryption with webauthn?

Answer 1

The protocol as it stands does not provide generic public key crypto services as far as I am aware. The best you can do is prove that a user is in possession of the private key related to the public key you hold.