Add virtual authenticator support for CMTG keys by nsatragno · Pull Request #2445 · w3c/webauthn

nsatragno · 2026-07-10T16:08:05Z

Adds virtual authenticator support for Credential Manager Trust Group (CMTG) keys.

This change extends virtual authenticator credentials to support a list of CMTG keys and an index to the "active" key. The key index may be used to switch which key is returned in an assertion. You can also set a new flag, generateCmtgKeyOnNextOperation, to return a new credential. This should allow web developers to test different scenarios, and browser developers to write web platform tests.

The new parameters are reflected in the add credential, get credentials, and set credential properties commands.

Finally, the change adds a new webdriver capability to indicate and request support for this feature.

The following tasks have been completed:

Modified Web platform tests (link)

Implementation commitment:

Closes #2395

Preview | Diff

timcappalli · 2026-07-17T15:24:23Z

+:: The <dfn abstract-op>locate the existing Credential Manager Trust Group Key</dfn> operation
+    returns the [=Credential Manager Trust Group Key=] associated with the current
+    [=public key credential source=], or `null` if none exists.

-    1. If the [=public key credential source=] is not [=backup eligible=],
-        terminate these processing steps as this extension only applies to [=multi-device credentials=].
+    The <dfn abstract-op>create a Credential Manager Trust Group Key</dfn> operation
+    takes a public key algorithm identifier, generates a new
+    [=Credential Manager Trust Group Key=] for the current
+    [=public key credential source=], and returns the generated key.

-    1. If a [=Credential Manager Trust Group Key=] does not already exist for this ([=public key credential source/id|Credential ID=],
-        [=public key credential source/rpId|RP ID=], [=public key credential source/userHandle|User Handle=]) tuple in the [=authenticator=]/[=credential manager=],
-        create it using the same public key algorithm as that used by the [=user credential=]'s [=credential key pair=],
-        otherwise locate the existing [=Credential Manager Trust Group Key=].
+    For both [=authenticatorMakeCredential=] and [=authenticatorGetAssertion=] operations:
+        1. Create or select the [=public key credential source=] as usual (see [[#sctn-op-make-cred]],
+            or [[#sctn-op-get-assertion]] as appropriate).

-    1. Let |cmtgPublicKey| be the newly created or existing [=Credential Manager Trust Group Key=],
-        in COSE_Key format [=credentialPublicKey|in the same fashion as for the user credential's credentialPublicKey=].
+        1. If the [=public key credential source=] is not [=backup eligible=],
+            terminate these processing steps as this extension only applies to [=multi-device credentials=].


Should we make these changes in a separate PR? These don't seem to be related to the virtual authenticator.

We could. These changes aren't supposed to be functional, they're there to make it easier to specify how the virtual authenticator retrieves and stores CMTGs.

To take a stronger stance here: these changes make it so we can cleanly inject behaviour here from the virtual authenticator. I would prefer to keep them here, since the changes don't stand on their own (but I could go either way if you thought it was important to move them to a new PR).

This change adds virtual authenticator support for Credential Manager Trust Group (CMTG) keys.

Expose Credential Manager Trust Group Keys related Virtual Authenticator methods on the content layer and have the generate_cmtg_key_on_next_operation flag be per credential instead of per authenticator. Also, process and filter the cmtgKey extension at the CTAP level. This will be used in the follow-up to support a new CDP API, following w3c/webauthn#2445. TAG=agy CONV=00274877-c5d3-46c3-a466-9346b48eefc4 Bug: 485888879 Change-Id: I08be13d8e81438894044becfe4265aea3cf68a5b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131079 Reviewed-by: Ken Buchanan <kenrb@chromium.org> Auto-Submit: Nina Satragno <nsatragno@chromium.org> Commit-Queue: Ken Buchanan <kenrb@chromium.org> Cr-Commit-Position: refs/heads/main@{#1665547}

Add the hasCmtgKey option to the WebAuthn.addVirtualAuthenticator CDP command. `hasCmtgKey` enables Credential Manager Trust Group Keys support for WebAuthn virtual authenticators. This is intended to be used by both devtools and webdriver. See w3c/webauthn#2445 TAG=agy CONV=00274877-c5d3-46c3-a466-9346b48eefc4 Bug: 485888879 Change-Id: I7da630ac0cd4decd9d5fab6079cfa84ccf1751b9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8132258 Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Auto-Submit: Nina Satragno <nsatragno@chromium.org> Commit-Queue: Andrey Kosyakov <caseq@chromium.org> Cr-Commit-Position: refs/heads/main@{#1665615}

Expose Credential Manager Trust Group (CMTG) Key virtual authenticator properties in WebAuthn.getCredential and WebAuthn.getCredentials. This is intended to be used by both devtools and webdriver. See w3c/webauthn#2445 TAG=agy CONV=00274877-c5d3-46c3-a466-9346b48eefc4 Bug: 485888879 Change-Id: Ia5009bbdec2363d7b8c560124d062b7125a81f18 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131780 Auto-Submit: Nina Satragno <nsatragno@chromium.org> Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Commit-Queue: Andrey Kosyakov <caseq@chromium.org> Cr-Commit-Position: refs/heads/main@{#1665620}

Allow injecting credentials with pre-configured Credential Manager Trust Group (CMTG) keys via WebAuthn.addCredential CDP command. This is intended to be used by both devtools and webdriver. See w3c/webauthn#2445 TAG=agy CONV=00274877-c5d3-46c3-a466-9346b48eefc4 Bug: 485888879 Change-Id: I56e4be1ebb3c8b44dd2cb3a974a03ffd857cf498 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8132417 Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Commit-Queue: Nina Satragno <nsatragno@chromium.org> Cr-Commit-Position: refs/heads/main@{#1666302}

Allow setting CMTG properties on credentials via the WebAuthn.setCredentialProperties CDP command. This is intended to be used by both devtools and webdriver. See w3c/webauthn#2445 TAG=agy CONV=00274877-c5d3-46c3-a466-9346b48eefc4 Bug: 485888879 Change-Id: I5dcecf1e6e2a760f8130fdddb5c997e2a575bc5f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131762 Commit-Queue: Nina Satragno <nsatragno@chromium.org> Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Cr-Commit-Position: refs/heads/main@{#1666311}

nsatragno self-assigned this Jul 10, 2026

nsatragno force-pushed the 11_cmtg_testing branch 3 times, most recently from f699eb1 to 0f31a9a Compare July 13, 2026 18:16

nsatragno marked this pull request as ready for review July 13, 2026 18:24

nsatragno requested review from MasterKale, pascoej and timcappalli July 13, 2026 18:25

nsatragno force-pushed the 11_cmtg_testing branch from 0f31a9a to d56931c Compare July 13, 2026 18:53

nsatragno changed the title ~~[WIP] Add virtual authenticator support for CMTG keys~~ Add virtual authenticator support for CMTG keys Jul 13, 2026

nsatragno force-pushed the 11_cmtg_testing branch 2 times, most recently from 46b7d3b to 170493a Compare July 14, 2026 14:50

timcappalli reviewed Jul 17, 2026

View reviewed changes

Comment thread index.bs Outdated

nsatragno force-pushed the 11_cmtg_testing branch from 170493a to 0e3653d Compare July 20, 2026 18:19

Add virtual authenticator support for CMTG keys

c45b834

This change adds virtual authenticator support for Credential Manager Trust Group (CMTG) keys.

nsatragno force-pushed the 11_cmtg_testing branch from 0e3653d to c45b834 Compare July 20, 2026 18:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add virtual authenticator support for CMTG keys#2445

Add virtual authenticator support for CMTG keys#2445
nsatragno wants to merge 1 commit into
w3c:2338-cmtgfrom
nsatragno:11_cmtg_testing

nsatragno commented Jul 10, 2026 •

edited by pr-preview Bot

Loading

Uh oh!

timcappalli Jul 17, 2026

Uh oh!

nsatragno Jul 17, 2026

Uh oh!

nsatragno Jul 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

nsatragno commented Jul 10, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timcappalli Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

nsatragno Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

nsatragno Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nsatragno commented Jul 10, 2026 •

edited by pr-preview Bot

Loading