Passkeys: MFA or not?

Question

According to different pages (e.g. OneIdentity, also a Google Security source I can't find anymore), using Passkeys does count as Multi Faktor Authentication. To my understanding, they argue, that the User needs

1. the device,
2. and needs to be able to unlock the key on the device, e.g. by using biometrics or a PIN.

So 2 factors, therefore MFA.

But still, the server only needs to validate one factor - the response sent after the challenge of the server. So for the server, it is not possible to verify, whether the user really needed two factors, or whether the private key was maybe in an unsecured location, and therefore it was only single factor.

I see this especially in contrast to methods using OTP as 2nd factor, where the server might get username+password and the OTP, and can verify both factors on the server side.

Is there any specification going into more detail, whether passkeys can also be considered as MFA and why? Or is there another term for something passkeys is trying to achieve here? (like "Client-side MFA"? :-) )

Answer 1

We get variants on this question quite a lot. The key factor here is that it's multi-factor authentication. Therefore, you need to have multi-factors of authentication for it to be MFA.

The underlying question is, who's the authenticator? If the authenticator is authenticating multiple factors, then it's MFA.

In a passkey situation, it's not the service that's doing the authenticating, it's your device. And if your device is doing the authenticating and it's authenticating multiple factors, it could be MFA, depending on the implementation.

This is in contrast to something like chained factors, where you have one factor that unlocks another factor, which is then authenticated. And that's a different scenario altogether.

Or, where you try to claim the authentication service itself is an authentication factor, which isn't a factor for the authentication system.

So with many passkey implementations, you have the authentication of the device to unlock the key that is sent to the remote service, often through biometrics. And possibly the authentication to unlock the device. And from that angle, it's not MFA, because there is only one authentication factor in each link in the chain of authenticators.

However, one can say that passkeys are more secure than MFA because of its local authentication and the existence of the chain. But at this point, you can't apply some term that involves "MFA" (unless it is). The term is "Passkey".

Answer 2

The server only validates the cryptographic response, not the individual factors, which relies on the device's security to ensure the biometric/PIN factor remains secure.

This is what I said in my comment- that the factor that makes Passkeys borderline MFA or not is because whether the device is jail broken, rooted, or has malware etc, is out of the server’s control. I think this is why Google and other organisations don’t ‘trust’ it as much as common methods.

So yes, this concept is called "Client-side MFA" since multiple factors are verified on the client before generating a server response. Also, the FIDO Alliance and WebAuth specifications support this security model.

Regulatory guidelines like NIST SP 800-63 also recognize the high security of Passkey MFA, because most of the time secure enclaves and such are secure and will remain secure.

Answer 3

To make things a bit clearer, let's regard this from an attacker's point of view. This assumes a typical Passkey implementation on a smartphone.

An attacker might steal the phone and bypass or break the authentication. Your fingerprint is not a secure password; you leave it everywhere. And apart from the good old gummi bear attack, there are newer approaches like BrutePrint.

However, BrutePrint should no longer work on recent smartphones (it's now mandatory for Android 10+ phones to implement a "secure pipeline", which should prevent injection of fingerprint data into the Application Processor Trusted Execution Environment; I think that's a requirement [C-2-8] for biometric sensors).

Regardless, there are ways to temporarily incapacitate the target person, for example through an attack vector known as a "Mickey Finn".

A traditional MFA would require the target person to voluntarily supply a secret. With Passkey, this is not required.

Technically, it's still MFA(*), but one of the factors is so weak that it doesn't improve security significantly over 1FA.

(*) The factors are Possession ("what you have") and Inherent Qualities ("what you are").