WebAuthn 101

Table of Contents

Passwordless - This article is part of a series.

Part 1: My First YubiKey

Part 2: Passkeys 101

Part 3: This Article

Achieving Passwordless with WebAuthn and FIDO2 standards.

Passkeys and WebAuthn let a user sign in with a cryptographic key pair instead of using ID/password.

Here’s the introduction of:

FIDO2: FIDO2 is the umbrella spec set from the FIDO Alliance.
Passkeys: A passkey is the consumer-friendly name for a discoverable WebAuthn credential, that sync across a user’s device.
WebAuthn: WebAuthn is its browser API (standardized by W3C) and CTAP¹ where the protocol between browser and authenticator.

WebAuthn
#

The attestation and assertion ceremonies use a key pair generated from authonticator.

WebAuthn also binds every signature to the origin and a server-issued challenge which makes it phishing-resistant.

Attestation
#

The registration (attestation) first creates a new key pair: private and public keys. Then the authenticator will:

stored the private key at a local secured storage.
and hands over the public key including the user ID to web server.

Assertion
#

The autthentication (assertion) proves possession of that private key by signing a server-issued challenge.

Portability
#

Passkeys can in generated in forms:

Passkeys
├── Roaming (1)
└── Platform
    ├── Device-bound (2)
    └── Synced (3)

1. Roaming
#

A roaming passkey is referring to those external authenticator that can moves between devices. Such as Yubikey or other esecurity key over USB, NFC, or bluetooth.

Another form of passkey is generated by a platform authenticator. Such as Touch ID, Windows Hello, Android’s Face ID / fingerprint.

And platform passkey can be either synced or device-bound.

2. Device-bound
#

Device-bound passkeys (the private key) never leave the secure environment hardware they were minted on. Such as TPM² (workstation), Secure Enclave (iPhone), or StrongBox (Android).

Device-bound passkeys are stronger against a compromised cloud account but create lockout risk.

3. Synced
#

Synced passkeys is generated the same way as devive-bound passkeys. And it is always the default form generated most of the time.

The difference is, it can be managed via iCloud Keychain, Google Password Manager, 1Password. They replicate the private key across the user’s devices through an end-to-end encrypted cloud.

For consumer apps, synced wins. For high-assurance internal systems, require a device-bound or roaming key.

Synced passkeys are dramatically better for recovery and adoption.

	Synced	Device-Bound
Portability	Follows the user across device	Stuck on 1 device
Recovery	Automatic via cloud	Lost (unless backup exists)
Attack surface	Cloud account compromise	Physical possession only
Best fit	Consumer	Regulated, high-assurance