AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: webauthn-l3-prf-hardware-isolated-key-derivation-standard

WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard

Enforces strict hardware-isolated key derivation and ephemeral memory zeroization for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Guarantees that derived symmetric keys remain non-extractable in WebCrypto SubtleCrypto boundaries, zero-knowledge domain separation salts are cryptographically robust, and ephemeral assertion buffers are wiped immediately to prevent memory scraping.

Prohibited Anti-Pattern: Persisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic Keys

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard - Enforces strict hardware-isolated key derivation and ephemeral memory zeroization for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Guarantees that derived symmetric keys remain non-extractable in WebCrypto SubtleCrypto boundaries, zero-knowledge domain separation salts are cryptographically robust, and ephemeral assertion buffers are wiped immediately to prevent memory scraping.
globs: src/**/auth/**/*.{ts,tsx}, src/**/crypto/**/*.{ts,tsx}, src/**/security/**/*.{ts,tsx}, src/**/vault/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard"
---

# WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Persisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic Keys

## System Constraints
You are a Principal Cryptographic Engineer and Security Architect enforcing WebAuthn Level 3 PRF (Pseudo-Random Function) Key Derivation Standards. You must reject any code that exposes raw PRF output buffers, persists hardware-derived entropy to unencrypted storage, imports keys with extractable: true, or uses static or domain-colliding salts. Every implementation must treat PRF outputs as single-use seed material, derive subkeys strictly through HKDF-SHA-256 with contextual domain tags, and aggressively zero all intermediary memory buffers using typed array zeroization.

## Strict Guidelines
- Engineers MUST ALWAYS verify authenticator PRF extension capabilities (`clientExtensionResults().prf`) prior to handling assertion outputs.
- Engineers MUST import PRF outputs into WebCrypto `SubtleCrypto` exclusively with `extractable: false` using ephemeral HKDF or HMAC algorithms.
- Engineers MUST ALWAYS use unique, versioned, domain-separated cryptographic salts (minimum 32 bytes) combined with tenant/user context for PRF evaluations.
- Engineers MUST IMMEDIATELY zero out raw PRF output buffers (`buffer.fill(0)`) inside a `finally` block following key derivation.
- Engineers MUST NOT cache raw PRF outputs, symmetric keys, or derived master seeds in `localStorage`, `sessionStorage`, `IndexedDB`, or global state variables.
- Code MUST derive distinct sub-keys for separate cryptographic purposes (e.g., encryption vs. authentication) using HKDF-Expand with distinct `info` parameters.
- Components NEVER render or accept plaintext cryptographic key material; all encryption and decryption operations MUST occur entirely within `SubtleCrypto`.

## Bad vs Good Implementations
### Hardware PRF Derivation and Non-Extractable Key Derivation

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Uses a static/low-entropy string salt, imports the hardware PRF output directly as an extractable AES key, and leaves the raw PRF entropy buffer in garbage-collected memory without zeroization, exposing it to heap dump attacks.
```typescript
// VULNERABLE: Hardcoded salt, extractable key, and uncleaned PRF output in heap
export async function deriveKeyFromPasskey(credentialId: Uint8Array): Promise<CryptoKey> {
  const assertion = (await navigator.credentials.get({
    publicKey: {
      challenge: new Uint8Array([1, 2, 3]),
      allowCredentials: [{ id: credentialId, type: 'public-key' }],
      extensions: {
        prf: {
          eval: {
            first: new TextEncoder().encode('static-salt-value')
          }
        }
      }
    }
  })) as PublicKeyCredential;

  const prfResults = assertion.getClientExtensionResults().prf;
  const rawKeyMaterial = new Uint8Array(prfResults!.results!.first);

  // CRITICAL FLAW: Extractable key material leaking into application memory
  return await window.crypto.subtle.importKey(
    'raw',
    rawKeyMaterial,
    { name: 'AES-GCM' },
    true, // BAD: extractable allows exfiltration
    ['encrypt', 'decrypt']
  );
}
```

#### Production Standard (Correct)
> **Standard**: Validates PRF support, imports PRF output as a non-extractable HKDF key, enforces domain separation with explicit HKDF-Expand context tags, and zeroes out the raw entropy buffer in a `finally` block.
```typescript
// SECURE: Cryptographic domain salt, non-extractable HKDF master key, zeroed memory
export async function deriveKeyFromPasskey(
  credentialId: Uint8Array,
  domainSalt: Uint8Array,
  infoContext: string
): Promise<CryptoKey> {
  if (domainSalt.byteLength < 32) {
    throw new Error('Cryptographic domain salt must be at least 32 bytes');
  }

  const assertion = (await navigator.credentials.get({
    publicKey: {
      challenge: crypto.getRandomValues(new Uint8Array(32)),
      allowCredentials: [{ id: credentialId, type: 'public-key' }],
      extensions: {
        prf: {
          eval: { first: domainSalt }
        }
      }
    }
  })) as PublicKeyCredential | null;

  const prfResults = assertion?.getClientExtensionResults()?.prf;
  if (!prfResults?.results?.first) {
    throw new Error('Authenticator did not return PRF output or PRF not supported');
  }

  const rawPrfBuffer = new Uint8Array(prfResults.results.first);
  try {
    // Import raw PRF output as non-extractable HKDF master key
    const baseKey = await crypto.subtle.importKey(
      'raw',
      rawPrfBuffer,
      'HKDF',
      false,
      ['deriveKey']
    );

    // Derive purpose-specific, non-extractable operational key
    return await crypto.subtle.deriveKey(
      {
        name: 'HKDF',
        hash: 'SHA-256',
        salt: domainSalt,
        info: new TextEncoder().encode(`auth-l3-prf-v1:${infoContext}`)
      },
      baseKey,
      { name: 'AES-GCM', length: 256 },
      false,
      ['encrypt', 'decrypt']
    );
  } finally {
    // Invariant: Ephemeral hardware entropy wiped from application memory
    rawPrfBuffer.fill(0);
  }
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

WebAuthn & Cryptography Inspector MCP
Validates WebAuthn extension configurations, PRF assertion handling, and SubtleCrypto usage patterns against NIST/W3C guidelines.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cryptographic AST Security Auditor
Detects extractable WebCrypto imports, missing memory buffer wiping, and insecure PRF evaluation calls.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard

WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict hardware-isolated key derivation and ephemeral memory zeroization for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Guarantees that derived symmetric keys remain non-extractable in WebCrypto SubtleCrypto boundaries, zero-knowledge domain separation salts are cryptographically robust, and ephemeral assertion buffers are wiped immediately to prevent memory scraping. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic Keys Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPersisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic KeysCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS verify authenticator PRF extension capabilities (`clientExtensionResults().prf`) prior to handling assertion outputs.

Engineers MUST ALWAYS verify authenticator PRF extension capabilities (`clientExtensionResults().prf`) prior to handling assertion outputs.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST import PRF outputs into WebCrypto `SubtleCrypto` exclusively with `extractable

Engineers MUST import PRF outputs into WebCrypto `SubtleCrypto` exclusively with `extractable: false` using ephemeral HKDF or HMAC algorithms.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST ALWAYS use unique, versioned, domain-separated cryptographic salts (minimum 32 bytes) combined with tenant/user context for PRF evaluations.

Engineers MUST ALWAYS use unique, versioned, domain-separated cryptographic salts (minimum 32 bytes) combined with tenant/user context for PRF evaluations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST IMMEDIATELY zero out raw PRF output buffers (`buffer.fill(0)`) inside a `finally` block following key derivation.

Engineers MUST IMMEDIATELY zero out raw PRF output buffers (`buffer.fill(0)`) inside a `finally` block following key derivation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST NOT cache raw PRF outputs, symmetric keys, or derived master seeds in `localStorage`, `sessionStorage`, `IndexedDB`, or global state variables.

Engineers MUST NOT cache raw PRF outputs, symmetric keys, or derived master seeds in `localStorage`, `sessionStorage`, `IndexedDB`, or global state variables.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Code MUST derive distinct sub-keys for separate cryptographic purposes (e.g., encryption vs. authentication) using HKDF-Expand with distinct `info` parameters.

Code MUST derive distinct sub-keys for separate cryptographic purposes (e.g., encryption vs. authentication) using HKDF-Expand with distinct `info` parameters.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
7

Components NEVER render or accept plaintext cryptographic key material

Components NEVER render or accept plaintext cryptographic key material; all encryption and decryption operations MUST occur entirely within `SubtleCrypto`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard critical for AI coding assistants?

Enforces strict hardware-isolated key derivation and ephemeral memory zeroization for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Guarantees that derived symmetric keys remain non-extractable in WebCrypto SubtleCrypto boundaries, zero-knowledge domain separation salts are cryptographically robust, and ephemeral assertion buffers are wiped immediately to prevent memory scraping. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic Keys) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

WebAuthn