PingOne Advanced Identity Cloud

WebAuthn storage & encryption settings

WebAuthn storage and encryption settings control how Advanced Identity Cloud stores and protects the device metadata registered by end users of WebAuthn authenticators, including passkeys and security keys.

By default, Advanced Identity Cloud creates the configuration with no encryption. For production environments, you should select an encryption scheme and store the associated key in an ESV secret.

Updating the encryption key store setting after end users have registered their devices isn’t supported. If you change encryption key information (in the configuration or in the secret stores) end users with existing device profiles can no longer sign on using their existing registered passkeys or security keys. You’ll need to delete each affected end user’s device profile so they can re-register the next time they sign on.

Learn more about configuring how Advanced Identity Cloud validates authenticator attestations in WebAuthn verification settings.

Configure WebAuthn storage & encryption settings

  1. In the Advanced Identity Cloud admin console, go to verified_user Authentication > Authentication Methods.

  2. Click WebAuthn Storage & Encryption.

  3. If WebAuthn storage & encryption is not already enabled, click Enable WebAuthn Storage & Encryption to create it with default settings before configuring it.

  4. Configure the following settings:

    Profile Storage Attribute

    The end user’s attribute in which to store WebAuthn profiles.

    Device Profile Encryption Scheme

    Encryption scheme to use to secure device profiles stored on the server.

    If enabled, each device profile is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the data.

    The possible values for this property are:

    • AES-256/HMAC-SHA-512 with RSA Key Wrapping

    • AES-128/HMAC-SHA-256 with RSA Key Wrapping

    • No encryption of device settings.

    Default value: No encryption of device settings.

    Encryption Key Store

    Path to the key store from which to load encryption keys.

    Updating this setting isn’t currently supported in Advanced Identity Cloud. Changing its value may lead to a loss of functionality in this feature.

    For greater security, store encryption key information in ESVs, instead of in the configuration. Use the secret label am.services.authenticatorwebauthn.encryption to map an alias for WebAuthn Profile Encryption secrets.

    If you update encryption key information in the configuration or in the secret stores, end users with existing device profiles can no longer sign on using their existing registered passkeys or security keys. Delete the end user’s device profile so that they can create a new one when they next sign on.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorwebauthn.encryption label in the realm’s ESV secret store, this value is ignored.
    Key Store Type

    Type of key store to load.

    This property is preconfigured in your Advanced Identity Cloud tenant and shouldn’t be altered.

    Default value: Java Cryptography Extension Key Store (JCEKS)

    Key Store Password

    Password to unlock the key store. This password is encrypted when it is saved in the Advanced Identity Cloud configuration.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorwebauthn.encryption label in the realm’s ESV secret store, this value is ignored.
    Key-Pair Alias

    Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorwebauthn.encryption label in the realm’s ESV secret store, this value is ignored.
    Private Key Password

    Password to unlock the private key.

  5. Click Save.