Introduction to FIDO Authentication and Passkeys.pptx

FIDO Seminar RSAC 2024

1. Introduction to FIDO and Passkeys Shane Weeden Senior Technical Staff Member, IBM

2. Agenda FIDO authentication in a nutshell What is a passkey? Security spectrum User experience The wrap

3. FIDO Authentication

4. FIDO authentication Client (computing device, user, authenticator with private key) Relying Party Server (website, FIDO server, user accounts with public keys) I’m ready to login Ok, here’s a random challenge Here’s the challenge signed with my private key Yep, that’s correct! Passwords FIDO A human generated symmetric secret Machine generated public key cryptography Often re-used across websites Bound to a single RP (relying party) Easily phished Phishing resistant Subject to credential stuffing, social engineering and server leakage Impractical to remotely attack

5. What is a passkey?

6. What is a passkey – let’s start with an example How I login at work

7. What is a passkey? Marketing Definition P asskeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. https:// fidoalliance.org /passkeys/ Technical Definition P asskeys are defined as any passwordless FIDO credential.

8. A syncable passkey is… A passkey that can be backed up and synchronized by the passkey provider across a user’s devices . A passkey provider might be a platform/OS vendor, or 3 rd -party software such as a password manager. Facilitates new device bootstrapping and simplifies account recovery. Security of syncable passkeys is the responsibility of the passkey provider. Passkey synchronization fabric

9. Another example Apple passkey using Safari on consumer website

10. Security Spectrum

11. password password+ Conditional MFA syncable passkey Device-bound passkey Security Spectrum

12. User Experience

13. Inspiration from Password Manager UX Autofill UI familiar for users Privacy preserving HTML / JS instrumentation for website developers <input id="username" type="text" autocomplete=" webauthn "> <script> navigator.credentials.get ({" publicKey ":{ "challenge":{ … }, "signal":{}, " mediation":"conditional "}) .then((assertion) => { … }); </script>

14. Cross-device authentication Also known as the hybrid flow. P asskey on mobile device can bootstrap another device. This can be the platform passkey, or that from a 3 rd party provider. You may wish to solicit platform authenticator registration after observing cross-device authentication.

15. Cross-platform authentication demo Using an iPhone to bootstrap sign-in to Chrome/Windows

16. The wrap

17. Other resources General Information FIDO Alliance - https:// fidoalliance.org /passkeys/ Developer Adoption passkeys.dev Includes links to many other resources

18. Wrapping up alternative to password, with enhanced security characteristics synchronized passkeys addresses account recovery hybrid flow for cross-device, cross-ecosystem sign in familiar UX

19. Thank you! Security Poor Easy Weak Strong