Joe’s external passkey ceremony

Prepared client only. Prefer Joe's fingerprint-capable FIDO2 USB security key on his independently controlled approval device. Samsung phone/QR is an additional option. A desktop may initiate public-data registration at the independently published HTTPS relying party, but never create, save or synchronize the private credential onto ATLAS. All exact proposal review and assertion initiation must occur on Joe's independent approval device outside ATLAS. A USB key or QR alone is not independent exact-change review. No actual hardware, fingerprint method, custody, enrollment or G1 result is proved by this page. Voice is not an approval factor.

Current page origin: . All public files stay in this page’s memory. The page makes no HTTP requests and does not enroll, apply changes or save credentials. WebAuthn uses the browser’s authenticator interface.

1. Prepare a public registration response

Joe’s external administrator must supply and pin this request. The public response becomes trusted only after that separate admin route verifies and enrolls it. Registration alone does not pass G1.

Joe-admin registration request JSON Request SHA256 from Joe’s external administrator Registration and approval device

Choose "Fingerprint security key (USB)" for Joe's selected roaming key. Confirm actual fingerprint use; user verification alone can also represent a PIN and is not biometric proof. Samsung phone/QR and a platform passkey on Joe's trusted separate device remain explicit alternatives; never select ATLAS for local credential storage. For a protected change, independently open the reviewed HTTPS page on Joe's approval device, inspect the complete pinned proposal and fresh challenge there, and initiate the assertion there. Device hints are advisory. Verify provider behavior, credential exclusion from ATLAS and a distinct usable backup before claiming those properties.

2. Inspect and approve one exact proposal

Load the exact retained proposal and a fresh CHALLENGE export from the protected governor. Compare both file pins through Joe’s trusted handoff. Choose any one currently registered Joe passkey. A generic login, an unregistered credential or a previous challenge cannot approve this proposal.

Exact proposal file (original UTF8 bytes) Exact proposal SHA256 from the protected handoff Protected governor CHALLENGE export JSON CHALLENGE export SHA256 from the protected handoff

Full original proposal text

Full original proposal bytes in base64

The downloaded assertion is public ceremony evidence. Return it with the unchanged proposal and challenge ID to the governor. Only the governor verifies the trusted credential, challenge, RP/origin, UP/UV, expiry and durable unused proposal nonce before applying. This page cannot change the trusted-key set. A usable alternate credential must already be enrolled before loss resilience can be proved.

Standards: W3C WebAuthn · FIDO passkeys.