Secure Payment Confirmation: Browser Bound Keys

Category: Miscellaneous
Type: New or changed feature
Status: Proposed (Chrome Proposed)
Intent stage: None

Breaking change: No
Enterprise impact: None
Chromium flag: enable-secure-payment-confirmation-browser-bound-key
Spec maturity: Working draft

WPT details: Web platform tests are in development. Test results will depend on the availability of a software implementation on platforms that do not support hardware cryptographic keys. Whether software implementation of BBK would be permitted is an open issue: https://github.com/w3c/secure-payment-confirmation/issues/288.

Summary

Adds an additional cryptographic signature over Secure Payment Confirmation assertions and credential creation. The corresponding private key is not synced across devices. This helps web developers meet requirements for device binding for payment transactions.

Motivation

This feature amends to Secure Payment Confirmation to keep up with syncing passkeys and device requirements for online payments. The Browser Bound Keys feature adds device binding in the browser to enabling payment use cases where device binding is required.

Standards & signals

Specification: https://w3c.github.io/secure-payment-confirmation/#sctn-browser-bound-key-store
Firefox: No signal — Firefox have never finalized their view on SPC, so we updated the original SPC issue with a note on this additional capability.
Safari: No signal — Safari have never finalized their view on SPC, so we updated the original SPC issue with a note on this additional capability.
Web developers: No signals
Tracking bug: https://issues.chromium.org/issues/377278827

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=secure-payment-confirmation-browser-bound-keys
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Secure%20Payment%20Confirmation%3A%20Browser%20Bound%20Keys
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Secure%20Payment%20Confirmation%3A%20Browser%20Bound%20Keys
Baseline status: https://webstatus.dev/?q=Secure%20Payment%20Confirmation%3A%20Browser%20Bound%20Keys

Docs: https://github.com/w3c/secure-payment-confirmation/issues/271 https://github.com/w3c/secure-payment-confirmation/pull/286 https://github.com/w3c/secure-payment-confirmation/pull/296

Samples: https://rsolomakhin.github.io/pr/spc-sync

Explainers: https://github.com/w3c/secure-payment-confirmation/issues/271

View on chromestatus.com