demo · wallet-bound step-up · reference-grade

Raise the authenticator assurance. Do not invent identity assurance.

Begin with a simulated federated AAL1 session, create a real P-256 device passkey, and answer a one-time binding challenge. A successful same-holder proof raises AAL to 2. IAL stays at 1, and unsupported identity claims stay denied.

Run the browser flowSee the infrastructure boundary
the control sequence

Login, bind, prove.

01 · baseline

Simulated login

The local demo IdP produces a real signed result, but it performs no identity proofing. Baseline: IAL1, AAL1.

02 · bind

Create a passkey

Your browser asks the platform authenticator to create a real ES256 credential with user verification.

03 · step up

Answer once

The enrolled key signs a fresh, one-time challenge. The verifier checks possession, UV, RP binding, and counter state.

live browser runner

Use this device's passkey.

Nothing starts automatically. Each WebAuthn prompt follows an explicit button press. Tokens, credential identifiers, and the demo linking secret remain only in this page's memory and are discarded on reload.

Requires a secure context and a browser with WebAuthn support.

expected outcome

Only one axis moves.

  • AAL 1 → 2: the device proves possession of the enrolled passkey with user verification.
  • IAL remains 1: a stronger authenticator does not repair the simulated upstream identity source.
  • Age and nationality remain denied: the credential does not assert evidence the flow never established.
  • Foreign authenticator fails: possession of a different key cannot satisfy the enrolled same-holder binding.