Using PRF Extension to encrypt user data

[lmarschall]

Hey guys,

last year, I read this article about using the PRF extension to retrieve an encryption key from a salt saved on the server. https://blog.millerti.me/2023/01/22/encrypting-data-in-the-browser-using-webauthn/

Now with the upcoming IOS 18 version, this extension functionality finally comes to safari as well 🙌
https://webkit.org/blog/15443/news-from-wwdc24-webkit-in-safari-18-beta/

And third, WebKit for Safari 18 beta adds support for the WebAuthn prf extension. It allows for retrieving a symmetric key from a passkey to use for the encryption of user data.

So I assume this is finally the time one can commit to the PRF extension to securely store user data without saving once private key data in the cloud?

Would be great to hear your feedback about this topic.

Best Regards

Lukas