Passkey’s are a new brand name for WebAuthn + CTAP2 from FIDO2 standards. The underlying technology uses FIDO2 compliant Public key Cryptography targeted for Web applications. Passkey makes the FIDO2 authentication method only available to people using hardware devices like Yubikeys available to everyone by making mobile phones and popular OSes supporting storage and syncing of the private keys used for authentication. 

Some keywords to quickly understand the technology:

WebAuthn/FIDO2 = Passkey

Discoverable Credential or discoverable WebAuthn/FIDO2 Credential = Passkey

FIDO2 devices and Passkeys generates Public – Private key pairs and then stores the private key securely. The public key is stored by a FIDO2 complaint backend service which then allows authentication. When a user wants to access a website in a computer using Passkeys, assuming the user has previously signed up using a mobile device, then the browser requests the mobile device to authenticate on behalf of the browser. Such communication between mobile devices and computers uses CTAP2 and the transport protocol is Bluetooth in the case of mobile devices (Both iOS and Android). In the case of devices like NFC rings, the transport protocol is replaced with NFC.

What is FIDO2 ?

Fast Identity Online (FIDO) is standard to handle password less authentication on mobile devices, web browsers and in operating systems. 

FIDO2 handles:

• Authentication
• Registration

What is WebAuthn ?

W3C standard for web authentication supported by major browsers. WebAuthn makes it possible to use websites using the FIDO2 authentication method.

What is CTAP2 ?

Client to Authenticator Protocol – Establishes connection with an external authenticator like a Mobile phone, Security key etc.

The underlying transport for CTAP is : NFC, USB HID, Bluetooth (smart and BLE)

Passkeys vs YubiKey

Copyable, Syncable, Sharable, Multi Device FIDO2/WebAuthn keys

Incorporating Passkey 

For incorporating Passkey, we would need support for the technology, ie authentication in the frontend and a back-end server which is FIDO2 complaint. The back-end system essentially stores Public keys corresponding to a device’s passkey and uses the same to process authentication requests it receives from Authenticators like Mobile devices or dedicated Multi Factor tools like YubiKey.

In a nutshell, any application wanting to provide support for Passkey must incorporate frontend support and use a backend. Popular services like Auth0 are already offering Passkey support.

Blockchains and Passkey

Since blockchains and Passkey’s are using Public Key encryption scheme, one obvious questions is whether it’s possible to use Passkey to access blockchains. Additionally is it possible to use Passkey with a popular Ethereum wallet like Metamask ?

The answer to this question is depends on the type of Encryption Algorithm, mostly Elliptic Curve used in generation of the keys in Passkeys (WebAuthn) and in the blockchains.

FIDO2 uses NIST FIPS 186-4 mentioned the Elliptic Curves mentioned in “Appendix D: Recommended Elliptic Curves for Federal Government Use” . secp256r1 aka NIST P-256 is suggested but Chains like Ethereum and Bitcoin uses secp256k1. EOSIO blockchain on the other hand added support for secp256r1.

Polkadot blockchain uses Schnorrkel signature scheme and the Curve25519 which are relatively new and not yet included in the NIST or FIDO2 specifications.

References

1. https://www.yubico.com/blog/a-yubico-faq-about-passkeys/
2. https://ethereum.stackexchange.com/questions/82530/why-ethereum-based-dapps-dont-use-webauthn
3. EOSIO support for secp256r1 :  https://web.archive.org/web/20230509092832/https://github.com/EOSIO/eos/pull/7421 & https://web.archive.org/web/20230508180031/https://github.com/Gimly-Blockchain/eosio-did-spec/issues/5
4. Safe Curves : https://web.archive.org/web/20230423144205/https://safecurves.cr.yp.to/
5. End user doc https://fidoalliance.org/how-fido-works/
6. Awesome Webauthn: https://github.com/herrjemand/awesome-webauthn
7. Encrypting data with a WebAuthn https://blog.millerti.me/2023/01/22/encrypting-data-in-the-browser-using-webauthn/
8. largeBlob : https://stackoverflow.com/questions/74705538/webauthn-api-ignores-most-extensions-largeblob
9. credBlob https://github.com/w3c/webauthn/issues/1613
10. https://lists.webkit.org/pipermail/webkit-dev/2021-March/031755.html

Over the last 3 months or so I have been receiving emails or Linkedin messages that generally talks about needing help with a software project. Initial emails simply shared a link to a bitbucket code base and requested to help with it. The profiles involved were all new Harvard educated individuals and easy to identity as scam.

The recent ones are bit more creative and are from Linkedin profiles which are much more believable with recommendations and long history.

Unlike the initial contacts who shared various code bases in Python or NodeJS in the first day itself, latest messages follows a multi day initiative.

On the third day, I got the code base and this time they also have a functional specification !

What’s in the code ?

The code provided seems to be slightly changed boilerplate code (LLMed ?) in React or Javascript with instructions to run locally. Somewhere in the code base there is an encoded function which is either loaded from an external URL or in one of the source files like the first screen shot in the image.

I took pains to use a secure environment to run the first of the lot which was attempting to access a blockchain wallet. The latest ones looks to be different and attempting to download external code. (Needs further verification.)

In any case, if you happen to get emails/messages requesting help with some code base and access to code, be careful and ignore if you are not sure about what its all about. Do not run the code on your computers!