Device check
W0 of the build plan. Answers whether this device can hold a NodVault key: does it
support the WebAuthn prf extension, is the output stable, and is user
verification actually enforced. Nothing is stored and nothing leaves this page.
It runs under the approver plane's RP id, not this page's hostname, because PRF output is scoped to the RP id and that id is frozen at the first enrolment. A device that passes under some other name has not been shown to pass under the one we will actually use.
1 · Environment
2 · Register a credential
Creates a throwaway credential asking for prf. The authenticator reports
whether it can do it at all.
3 · Evaluate the PRF, twice
Derives a secret from a fixed salt, twice, and compares. Stability is the whole premise — an output that changes between calls cannot wrap a key. Also derives from a second salt, which must differ. Three prompts, one after another — keep this window focused throughout.