WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard

--- description: WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard - Enforces deterministic, instant memory zeroization of raw WebAuthn PRF (Pseudo-Random Function) extension outputs and derived symmetric encryption keys. Eliminates retention of plaintext key material in browser heap allocations to mitigate memory dump exfiltration, heap inspection, and side-channel extraction. globs: src/**/*.{ts,tsx}, packages/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-prf-ephemeral-key-zeroization-standard" --- # WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Retaining raw WebAuthn PRF output buffers or converting symmetric keys to immutable strings without deterministic zeroization in try/finally blocks ## System Constraints You are a Principal Security Architect enforcing the WebAuthn Level 3 PRF Ephemeral Key Zeroization Standard. WebAuthn PRF outputs and intermediate buffers must never remain in memory post-operation or be translated into garbage-collected immutable primitives like JavaScript strings. ## Strict Guidelines - Engineers MUST ALWAYS wrap raw PRF output buffers in try...finally blocks that execute deterministic memory zeroization immediately after Web Crypto import. - Engineers MUST NEVER convert raw PRF material, intermediate salt buffers, or plaintext cryptograms into JavaScript strings, as JS strings are immutable and cannot be zeroized. - Code MUST use Web Crypto SubtleCrypto.importKey with `extractable: false` when converting zeroized PRF buffers into symmetric keys (e.g., AES-GCM or HMAC). - Buffers MUST be zeroed using both `crypto.getRandomValues(uint8View)` and subsequent `.fill(0)` in `finally` blocks to mitigate compiler dead-store elimination (DSE) and hardware trace residue. - Components NEVER store raw PRF bytes or decrypted plaintext arrays in React state, global singletons, long-lived closures, or local storage. ## Bad vs Good Implementations ### WebAuthn PRF Result Ingestion and Key Derivation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The raw PRF output ArrayBuffer is retained indefinitely in memory without explicit wiping. Setting `extractable: true` allows arbitrary memory exfiltration, and leaving buffers to JavaScript garbage collection exposes keys to heap dumps and side-channel reads. ```typescript export async function decryptWithPrfBad( assertion: AuthenticationExtensionsClientOutputs, ciphertext: Uint8Array, iv: Uint8Array ): Promise<Uint8Array> { // Flaw 1: Unchecked property access and raw buffer retention const rawPrf = assertion.prf?.results?.first as ArrayBuffer; // Flaw 2: extractable: true allows key material exfiltration const key = await window.crypto.subtle.importKey( 'raw', rawPrf, { name: 'AES-GCM' }, true, ['decrypt'] ); // Flaw 3: rawPrf is left on heap for GC; no deterministic zeroization const decrypted = await window.crypto.subtle.decrypt( { name: 'AES-GCM', iv }, key, ciphertext ); return new Uint8Array(decrypted); } ``` #### Production Standard (Correct) > **Standard**: The PRF key bytes are imported as non-extractable keys (`extractable: false`) within a strict `try...finally` block. Memory is deterministically wiped using `crypto.getRandomValues()` followed by `.fill(0)` on both the local buffer and the original extension response, ensuring zero lingering key material. ```typescript export async function decryptWithPrfGood( assertion: AuthenticationExtensionsClientOutputs, ciphertext: Uint8Array, iv: Uint8Array ): Promise<Uint8Array> { const rawPrfBuffer = assertion.prf?.results?.first; if (!(rawPrfBuffer instanceof ArrayBuffer)) { throw new TypeError('Expected valid PRF ArrayBuffer from authenticator'); } // Create isolated copy to protect external references while allowing wipe const ephemeralKeyBytes = new Uint8Array(rawPrfBuffer.slice(0)); try { const cryptoKey = await window.crypto.subtle.importKey( 'raw', ephemeralKeyBytes, { name: 'AES-GCM', length: 256 }, false, // Invariant: PRF keys must never be extractable ['decrypt'] ); const decryptedBuffer = await window.crypto.subtle.decrypt( { name: 'AES-GCM', iv }, cryptoKey, ciphertext ); return new Uint8Array(decryptedBuffer); } finally { // Defeat dead-store elimination (DSE) by randomizing before wiping window.crypto.getRandomValues(ephemeralKeyBytes); ephemeralKeyBytes.fill(0); // Zeroize the authenticator extension output buffer directly if mutable const originalView = new Uint8Array(rawPrfBuffer); window.crypto.getRandomValues(originalView); originalView.fill(0); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard

WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, instant memory zeroization of raw WebAuthn PRF (Pseudo-Random Function) extension outputs and derived symmetric encryption keys. Eliminates retention of plaintext key material in browser heap allocations to mitigate memory dump exfiltration, heap inspection, and side-channel extraction. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Retaining raw WebAuthn PRF output buffers or converting symmetric keys to immutable strings without deterministic zeroization in try/finally blocks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Retaining raw WebAuthn PRF output buffers or converting symmetric keys to immutable strings without deterministic zeroization in try/finally blocks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS wrap raw PRF output buffers in try...finally blocks that execute deterministic memory zeroization immediately after Web Crypto import.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.