Webauthn and AAL2

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

We would like to require aal2, and in my understanding, a FIDO authenticator with a built-in biometrical challenge (e.g. Yubikey Bio, iPhone with face ID) would already fulfill the criteria for aal2. However, logging in with such a device when Webauthn is configured for passwordless authentication will only result in aal1.

Describe your ideal solution

At the moment, Webauthn can either be enabled as a second factor, or as a first factor instead of a password. In the latter case, Kratos will return aal1 when the user authenticates with a Webauthn device only. However, there are Webauthn devices with built-in biometric scanners. I believe these are called user-verifying platform authenticators in the specification. The RP can determine the user verification status by reading the UV flag in the authenticator data. So if I understand it correctly, Kratos should return aal2 if that UV flag is set to 1.

• https://w3c.github.io/webauthn/#user-verification
• https://w3c.github.io/webauthn/#authdata-flags-uv
• https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases.pdf

Workarounds or alternatives

None. Currently, a user needs to set up TOTP in addition to a user-verifying platform authenticator if 2fa is required.

Version

0.10.1

Additional Context

Moved from discussion: https://github.com/ory/kratos/discussions/2702