Skip to content

Passkeys

Resources:

Overview

Basic idea: replace passwords - and login names.

Instead a device creates “keys” when registering with a service, that are later used for login.

These keys can be stored only locally, on external authenticators, or get synced through cloud services with other devices.

A passkey is tightly coupled to the website it was created for. The browser won’t use it on a different website, preventing phishing attacks.

External authenticators

FIDO U2F, FIDO2 CTAP1

For some time the standard for external (two-factor) authenticators was “U2F” (Yubikey, Nitrokey, …).

U2F doesn’t require any state on the authenticator; it doesn’t known which services it was registered with, but can derive unique keys for each service.

As it is stateless it isn’t suitable to replace a login identifier.

U2F was now renamed to “FIDO2 CTAP1”; U2F is not a “Passkey”.

FIDO2 CTAP2

This is the new protocol for external authenticators to act as Passkey; support for it is often just listed as “FIDO2”.

As it requires state on the key they can only store a limited number of “Discoverable Credentials”.

If the specs say something about “unlimited” they are very likely talking about U2F, not CTAP2.

Todo

External authenticators try to store sensitive data in a protected way; they’ll likely use words like “tamper-resistant” to describe this feature.

It is unclear whether the “Discoverable Credentials” actually need such protection; after all the authenticator could still derive unique private keys from a single master secret, which would allow storing the “Discoverable Credentials” on way cheaper (and bigger) storage.

Todo

CTAP2 should also support CDA (“Cross-Device Authentication”) through a “hybrid transport”, i.e. using the phone (“CDA authenticator”) to authenticate on a PC (“CDA client”).

Unclear if there is a generic protocol for that?

Probably requires some kind of presence check via BLE (“Bluetooth Low Energy”) or NFC?

Terminology

FIDO2 CTAP

Client to Authenticator Protocols

FIDO U2F

Universal Second Factor

FIDO UAF

Universal Authentication Framework

WebAuthn

the standard for a Javascript API in browsers to support all this