Enterprise Passkey Export and Data Portability

​

1. Executive Overview

​

1.1 Private Cloud Enterprise Capabilities

• Automated Daily Data Archival: Production-grade automated export processes execute daily, creating immutable authentication data archives in industry-standard formats
• Enterprise-Grade Security Architecture: All exports are secured using AWS S3’s enterprise security features, including encryption at rest (AES-256) and in transit (TLS 1.3)
• Management Console Integration: Executive dashboards and administrative interfaces provide controlled access to historical authentication data exports
• Complete Data Portability: Full WebAuthn credential export enables seamless migration to alternative authentication providers or in-house systems
• Vendor Independence Assurance: Comprehensive data export capabilities ensure your organization retains the ability to transition authentication providers without service disruption

Passkey Export List

​

1.2 Strategic Business Applications

• Regulatory Audit Readiness: Maintain comprehensive authentication data archives to satisfy regulatory examination requirements from banking supervisors, financial regulators, and compliance auditors
• Vendor Substitution Rights: Exercise contractual rights for vendor replacement without data loss, ensuring compliance with procurement regulations and vendor risk management policies
• National Payment Network Resilience: Meet national infrastructure requirements for payment service providers, including data localization, sovereignty, and disaster recovery mandates
• Business Continuity Planning: Implement vendor-independent authentication data backup strategies beyond Corbado’s existing disaster recovery infrastructure, enabling restoration without vendor support in extreme scenarios while maintaining alignment with Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
• Multi-Jurisdictional Compliance: Address data residency requirements, cross-border data transfer regulations, and jurisdiction-specific authentication data retention policies
• Exit Strategy Implementation: Execute pre-defined vendor transition plans with zero authentication data loss, maintaining service continuity during provider changes
• Operational Risk Management: Mitigate single points of failure in authentication infrastructure through comprehensive data export and portability capabilities

​

1.3 Storage Architecture Options

​

1.3.1 Standard Private Cloud: Corbado-Managed Dedicated Storage

• Dedicated Storage: Your passkey exports are stored in an S3 bucket exclusively allocated to your organization within your dedicated Corbado installation
• Management Console Access: Download URLs for exported files are readily available through the Corbado Management Console
• Manual Download Capability: Authorized administrators can initiate downloads on-demand for compliance audits, migrations, or backup purposes
• Secure Access: All downloads require authentication through the Management Console with role-based access controls
• Data Retention: Standard 3-day retention with automated cleanup, configurable based on your requirements

Amazon S3 configuration (Corbado account)

​

1.3.2 Advanced Private Cloud: Customer-Controlled Storage Infrastructure

• Secure Access Control: Corbado accesses your storage using temporary, limited-scope credentials that you control and can revoke at any time
• Data Ownership: All exported data is immediately owned by your organization upon delivery, with no retained access by Corbado
• Encryption at Rest: Supports your organization’s encryption keys, ensuring only you can decrypt the exported authentication data
• Audit Trail: All data transfers are logged and traceable for compliance reporting and security audits
• Tenant Isolation: Each customer’s exports are cryptographically isolated using unique identifiers to prevent any cross-tenant data access

Amazon S3 configuration (own account)

​

1.3.3 Private Cloud Enterprise Plus Addon: Custom Storage Solutions

• Alternative Cloud Providers: Integration with Azure Blob Storage, Google Cloud Storage, or other enterprise storage platforms
• On-Premises Delivery: Direct delivery to on-premises storage systems via secure channels (SFTP, AWS Storage Gateway, or dedicated connectivity)
• Geographic Data Residency: Region-specific storage with configurable data sovereignty controls
• Custom Retention Policies: Automated lifecycle management aligned with your organization’s data retention requirements
• Multi-Region Replication: Automated replication to multiple storage locations for enhanced disaster recovery

HTTP endpoint configuration

​

2. Technical Specifications: Export Data Schema

​

2.1 Data Format and Compliance Standards

• W3C WebAuthn Specification compliance for credential data representation
• RFC 4648 Section 5 encoding standards for cryptographic materials
• ISO 8601 timestamp formatting for audit trail compatibility
• CSV RFC 4180 formatting for maximum interoperability

​

2.2 Authentication Data Field Specifications

​

3. Enterprise Integration and Migration Pathways

​

3.1 Vendor Transition and Business Continuity Implementation

• Execute vendor transitions within defined maintenance windows
• Maintain authentication service availability during provider migrations
• Preserve user authentication history for compliance and audit purposes
• Implement multi-vendor authentication strategies for risk mitigation

​

3.2 Enterprise Authentication Platform Compatibility

​

3.2.1 Enterprise Development Frameworks

• JavaScript/TypeScript: SimpleWebAuthn - Production-ready WebAuthn implementation for Node.js and browser environments
• Python: py_webauthn - Enterprise Python library supporting Django, Flask, and FastAPI integrations
• Go: go-webauthn/webauthn - High-performance implementation for microservices architectures
• Java: webauthn4j, Yubico Java WebAuthn Server - Enterprise Java solutions for Spring Boot and Jakarta EE
• C#/.NET: Fido2NetLib - Microsoft-ecosystem compatible library for .NET Core and Azure deployments
• PHP: lbuchs/WebAuthn - Production-grade PHP implementation for Laravel and Symfony frameworks

​

3.3 Reference Implementation: Migration Pattern

function loadCredentialsFromCSV(): void {
  try {
    const csvPath = path.join(__dirname, '2025-09-15.csv');
    const csvContent = fs.readFileSync(csvPath, 'utf-8');

    const records = parse(csvContent, {
      columns: true,
      skip_empty_lines: true,
    }) as CSVRecord[];

    for (const record of records) {
      if (record.status === 'active') {
        // Parse base64url encoded fields
        const credentialId = Buffer.from(record.credentialId, 'base64url');
        const publicKey = Buffer.from(record.publicKey, 'base64url');

        // Parse transports
        const transports = record.transports.split(';').map((t: string) => t.trim()) as AuthenticatorTransport[];

        const credential: WebAuthnCredential = {
          id: credentialId.toString('base64url'),
          publicKey: publicKey,
          counter: parseInt(record.authenticatorSignCount, 10),
          transports: transports,
        };

        // Add credential to the default user
        const user = inMemoryUserDB[loggedInUserId];
        if (user) {
          // Check if credential already exists by comparing credential IDs
          const existingCred = user.credentials.find(cred =>
            cred.id === credential.id
          );

          if (!existingCred) {
            user.credentials.push(credential);
            console.log(`Loaded credential from CSV: ${record.credentialId}`);
          }
        }
      }
    }

    console.log(`Loaded ${inMemoryUserDB[loggedInUserId].credentials.length} credentials from CSV`);
  } catch (error) {
    console.warn('Could not load credentials from CSV:', error);
  }
}

• Credential Filtering: Processes only active credentials to maintain authentication system integrity
• Cryptographic Material Handling: Properly decodes Base64URL-encoded credential IDs and public keys per WebAuthn specifications
• Transport Protocol Parsing: Maintains multi-factor authentication compatibility through transport method preservation
• Idempotent Import Logic: Implements duplicate detection to ensure safe re-execution during migration testing
• Operational Visibility: Provides console output for migration validation and troubleshooting

​

4. Checksum Verification and Data Integrity

​

4.1 Enterprise-Grade Data Integrity Controls

• Regulatory Compliance: Satisfies data integrity requirements for financial services, healthcare, and government sectors
• Audit Trail Validation: Provides cryptographic proof of data integrity for compliance auditors and security teams
• Tamper Detection: Enables immediate identification of any unauthorized modifications to exported authentication data
• Chain of Custody: Establishes verifiable chain of custody for authentication data from export to import

​

4.2 CRC64NVME Checksum Implementation

​

4.3 Verification Procedure and Implementation

"""
Compute CRC64NVME checksum of a file using AWS CRT library.

This uses the official AWS CRT implementation for CRC64NVME checksums,
which matches the S3 `x-amz-checksum-crc64-nvme`/`ChecksumCRC64NVME` value.
"""

from awscrt import checksums
import base64
import sys
import os

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 crc64nvme.py <file>", file=sys.stderr)
        return 1

    filepath = sys.argv[1]
    if not os.path.isfile(filepath):
        print(f"Error: '{filepath}' is not a file", file=sys.stderr)
        return 1

    with open(filepath, 'rb') as f:
        file_data = f.read()

    checksum = checksums.crc64nvme(file_data)
    checksum_bytes = checksum.to_bytes(8, byteorder='big')
    checksum_base64 = base64.b64encode(checksum_bytes).decode('ascii')

    print(checksum_base64)

    return 0

if __name__ == "__main__":
    sys.exit(main())

# Create isolated Python virtual environment
python3 -m venv checksum-verification
source checksum-verification/bin/activate

# Install AWS CRT library for official CRC64NVME implementation
pip3 install awscrt

# Verify export file integrity
python3 crc64nvme.py /path/to/export/file.csv.gz
=> 5yuiJSxKKnU=