# Mod sign WebauthN

#### Register credential sequence

{% @mermaid/diagram content="sequenceDiagram
participant User
participant DApp
participant Account
participant ModSign as ModSignWebAuthn

```
User->>DApp: Initiate credential registration
DApp->>Account: register_credential_request
Account->>Account: Select appropriate sign module
Account->>ModSign: register_credential_request
ModSign-->>Account: Provide registration data
Account-->>DApp: Return registration challenge
DApp-->>User: Display challenge for biometric registration

User->>DApp: Submit signed registration data
DApp->>Account: register_credential_response(signed_data)
Account->>Account: Verify signed data
Account->>ModSign: register_credential(signed_data)
ModSign-->>Account: Store credential in user-specific storage
Account-->>DApp: Confirm registration
DApp-->>User: Display registration success
```

" %}

#### Signature validation sequence

{% @mermaid/diagram content="sequenceDiagram
participant User
participant DApp
participant Account
participant ModValidation as ValidationModule
participant ModSign as ModSignWebAuthn

```
User->>DApp: Request token transfer
DApp->>Account: execute_user(token_transfer_operation)
Account->>Account: Select validation module based on scope
Account->>ModValidation: is_valid_operation(token_transfer_operation)
ModValidation->>Account: is_valid_signature(signature)
Account->>Account: Select sign module
Account->>ModSign: is_valid_signature(WebAuthn_signature)
ModSign->>ModSign: Retrieve user credentials
ModSign->>ModSign: Verify WebAuthn signature with public key
ModSign-->>Account: Return (valid/invalid)
ModValidation-->>Account: Return (valid/invalid)
Account->>Account: Execute token transfer operation
Account-->>DApp: Return transaction status
```

" %}

### **Overview**

`ModSignWebauthn` is a module within the Veive protocol that introduces the WebAuthn standard for signing transactions. WebAuthn, part of the FIDO2 project, enables strong authentication using public key cryptography. This module allows users to register their devices and authenticate using passkeys, enhancing security and usability.

### **Purpose**

WebAuthn is a web standard for secure authentication, using devices like security keys, smartphones, or built-in platform authenticators (like Windows Hello or Touch ID). Passkeys are the credentials generated during the registration process, comprising a public-private key pair. The public key is stored on the server (or, in this case, on the blockchain), while the private key remains securely on the user's device.

#### **Key Components in WebAuthn**

* **Credential ID**: A unique identifier for each registered credential, used to retrieve the public key associated with a user.
* **Public Key**: The public portion of the key pair, used by the server to verify signatures created by the private key.
* **Authenticator Data**: Information provided by the authenticator, including the signature.

#### **How `ModSignWebauthn` Works**

1. **Registration**:
   * Users register their devices, generating a public-private key pair. The `register` method stores the public key and the credential ID on the blockchain, linking them to the user's account.
2. **Signature Validation**:
   * When a transaction is signed using WebAuthn, the `is_valid_signature` method is called to validate the signature. This method checks if the signature is valid by:
     * Decoding the transaction's signature data to extract the `credential_id`, `authenticator_data`, and `client_data`.
     * Retrieving the stored public key using the `credential_id`.
     * Verifying the signature against the extracted message using the public key.