3 ms·
AFAIK passkeys are not a protocol. They are cryptographic key pairs (public and private keys). Private key is stored on a device and public key on a server. Pri
by zigzag312 2y ago
AFAIK passkeys are not a protocol. They are cryptographic key pairs (public and private keys). Private key is stored on a device and public key on a server. Private key often is device bound, and it never leaves the device. That's where a challenge response protocol comes in. It enables to provide proof of private key ownership without exposing the private key and it should also prevent replay attacks.
- dcow 2y agoNo. A _passkey_ is a syncable non-attested key pair used during wenauthn flows, by definition.
- zigzag312 2y agoSo, a passkey is not either a protocol or any key pair, but a key pair used in a specific protocol.
- dcow 2y agoYes “passkeys” is a marketing term that refers to the consumer oriented subset of webauthn. You can colloquially refer to an individual key pair as a passkey, when used in this context.