Introduced in Passwordstate Version 9 Build 9905, passkeys are a phishing resistant credential that can be used to replace passwords. It is a cryptographic credential, based on asymmetric public-key cryptography and uses a public-private key pair. The webserver or Relying Party has the public key associated with the account. The users Authenticator holds the private key for the account.
The specification for passkeys falls under FIDO2 and the World Wide Web Consortium’s (W3C) Web Authentication or WebAuthn specifications.
Passkeys allow a user to sign in to websites using a similar process to how they unlock their device, using biometrics, a PIN, or a pattern. They are typically used instead of entering a username and password combination on a login page.
In the Passwordstate implementation, the passkey’s private key is stored inside the corresponding Password Record. This means that wherever the user logs into Passwordstate from, so long as our Browser Extension has authenticated back to Passwordstate, the user can access and utilise their passkeys, or the corresponding username and password combination, to login into the website.
High Level Workflow
The diagram below demonstrates the workflow related to a website login using a passkey. This is a high level representation and is not intended to be an in-depth technical description of the process,
- The User browses to the login page of a website they have a passkey for. Note the browser is termed the User Agent and the website is referred to as the Relying Party in this workflow. Typically, the user will select a prompt to either login with username and password, or, login with passkey.
- When selecting to login with passkey the Relying Party (website) issues a Challenge to the User Agent (web browser) for the credential id of the user. Remember, the Relying Party only has the public key relating to the public-private key pair.
- The User Agent forwards the challenge to the Authenticator (the Passwordstate Browser Extension) for the corresponding private key stored in the Password Record for that website. The User Agent then prompts to User for verification to use this passkey to login to the website. On positive verification, the Authenticator uses the stored private key to sign the Challenge. This creates the cryptographic signature which is sent back to the User Agent.
- The User Agent verifies the cryptographic signature using the public key and informs the Relaying Party of a successful authentication. The website now responds and admits the authenticated user.
Real Example: Adding A Passkey!
The example we are using in this blog is for the Target website. We have previously created a username and password combination and saved this Password Record in Passwordstate. Next, we login to the website, navigate to settings and click on Sign in & Security (image below),
This takes us to the Sign in & Security settings, where we have the option of creating a Passkey by clicking on the Add passkey button (image below),
When clicking on the Add passkey button, the Passwordstate Browser Extension will prompt to save the Passkey to the existing Password Record used to login to the website (image below),
On clicking Save, the private key belonging to the private-public key-pair is saved in the Password Record. The public key belonging to the private-public key is saved by the website. The website will then typically display a message that the passkey has been created (image below),
The passkey is now available for use.
Real Example: Login With Your Passkey!
In case you missed the notification on screen, most websites will send through an email advising your passkey has now been added to your account. The Target example is shown below,
Now, when browsing to the login page of the website, we can elect to either login using our Username and Password combination, or by using our passkey. When clicking on the Sign in with passkey, the website will issue the challenge and Passwordstate’s Browser Extension will prompt to Login with Passkey?
When clicking on the Browser Extension Login button, the private key for the private-public key pair will be retrieved (image below),
the Browser Extension will sign the challenge request using the private key, the web browser will validate the cryptographic signature using the public key and confirm a successful authentication to the website. The website will now accept the authenticated request and permit us entry.
Your Password Record
As stated previously, the passkey private key is saved to the Password Record. The image below shows the Password Record used for this example.
Benefits of Passkeys
Organizations who implement support for passkeys typically see the following benefits as passkey use increases:
- Safer, more secure, and faster online experiences for users
- Reductions in phishing, credential stuffing, and a reduction in attack surface