4 ms·
Per this: https://www.slashid.dev/blog/passkeys-deepdive/ https://www.slashid.dev/blog/passkeys-deepdive/ The private key is both kept in your phone’s Secure E
by cstrahan 3y ago
Per this: https://www.slashid.dev/blog/passkeys-deepdive/ https://www.slashid.dev/blog/passkeys-deepdive/
The private key is both kept in your phone’s Secure Enclave and stored in iCloud, so strictly speaking the implementation isn’t hardware-bound in that case.
But I think the intended point is something more practical: can you, as a user, export the passkey to be shared on your non-Apple laptop, phone, etc? And maybe I’m mistaken, but I’ve been under the impression that you cannot.
- snagg 3y agoHi, I'm the author of the blogpost. You are spot on, Passkeys are exportable so the private key ends up both on iCloud and the Enclave/authenticator. My understanding is that there's chatter about cross-vendor synchronization of passkeys but nothing concrete yet. Meanwhile Apple allows people to share Passkeys via AirDrop (Settings > Passwords - select the passkey you want and click the "Share" icon to send it over Airdrop) so it should be possible with some effort to obtain the private key with something like this: https://github.com/seemoo-lab/opendrop https://github.com/seemoo-lab/opendrop. Haven't done extensive testing yet though, so I can't confirm. Would love to hear if anybody knows more about how the sharing via AirDrop is implemented/protected.
- judge2020 3y agoGiven it sync from iCloud, you probably could export with enough prying at the MacOS Keychain app, but exporting them out is not a supported use case yet.
- vbezhenar 3y agoIf macOS can download it from iCloud, with enough reverse engineering you should be able to use the same APIs.
- michaelt 3y agoUnless iCloud only lets you download it in a form only the secure enclave can decrypt.
- spear 3y agoI'm pretty sure my 2017 Macbook Pro (Intel, no Touch Bar) doesn't have a Secure Enclave chip, yet it supports Passkeys.
- snagg 3y agoHi, I'm the author of the SlashID blogpost. You are right, the WebAuthn standard doesn't provide any guarantees on the authenticator storage security hence passkeys (and WebAuthn creds) can be stored in anything that speaks CTAP2. We wrote a follow-up blogpost talking about the threat model in which we touch on the above: https://www.slashid.dev/blog/passkeys-security-implementation/#security-and-threat-modeling https://www.slashid.dev/blog/passkeys-security-implementatio...