开发者Filippo Valsorda提出了一套可互操作的Passkey记录存储格式规范，旨在简化服务器端实现Passkey认证的复杂性 [1]。该规范草案采用类似PHC Strings的语法来存储Passkey记录 [1]，以避免数据库模式锁定 [1]。
基于这一规范，Valsorda设计了一个无状态的Go语言加密API，集成了RelyingParty.NewRegistration和RelyingParty.NewLogin等核心方法 [1]，目的是简化注册和登录流程的开发 [1]。该规范与API目前仍处于提案阶段 [1]。
在安全实践方面，该方案建议通过用户ID查找而非Credential ID索引的方式来避免凭证ID冲突攻击 [1]。
Valsorda计划向Go社区征求反馈，并作为提案提交给Go 1.28版本 [1]。
A standardized format for storing passkey records has been proposed to address complexity in server-side passkey implementation and prevent database schema lock-in. [1] The specification, designated c2sp.org/passkey-record, adopts syntax similar to PHC Strings for encoding passkey records. [1]
Accompanying the specification is a stateless Go cryptography and passkey API designed to streamline registration and login workflows. [1] The API includes core methods such as RelyingParty.NewRegistration and RelyingParty.NewLogin. [1]
The specification and API remain in proposal stage, with the author planning to submit the API as a candidate for inclusion in Go 1.28's standard library. [1] One key design principle involves looking up credentials by user ID rather than credential ID to prevent credential ID collision attacks. [1] Community feedback is being sought to advance the proposal. [1]