可互操作的Passkey记录规范与Go API方案公布

开发者Filippo Valsorda提出了一套可互操作的Passkey记录存储格式规范，旨在简化服务器端实现Passkey认证的复杂性 1。该规范草案采用类似PHC Strings的语法来存储Passkey记录 1，以避免数据库模式锁定 1。

基于这一规范，Valsorda设计了一个无状态的Go语言加密API，集成了RelyingParty.NewRegistration和RelyingParty.NewLogin等核心方法 1，目的是简化注册和登录流程的开发 1。该规范与API目前仍处于提案阶段 1。

在安全实践方面，该方案建议通过用户ID查找而非Credential ID索引的方式来避免凭证ID冲突攻击 1。

Valsorda计划向Go社区征求反馈，并作为提案提交给Go 1.28版本 1。

A standardized format for storing passkey records has been proposed to address complexity in server-side passkey implementation and prevent database schema lock-in. 1 The specification, designated c2sp.org/passkey-record, adopts syntax similar to PHC Strings for encoding passkey records. 1

Accompanying the specification is a stateless Go cryptography and passkey API designed to streamline registration and login workflows. 1 The API includes core methods such as RelyingParty.NewRegistration and RelyingParty.NewLogin. 1

The specification and API remain in proposal stage, with the author planning to submit the API as a candidate for inclusion in Go 1.28's standard library. 1 One key design principle involves looking up credentials by user ID rather than credential ID to prevent credential ID collision attacks. 1 Community feedback is being sought to advance the proposal. 1