Both seem to use the same key elements:
- a private, user-resident "master key" thus not relying on a 3rd party like OAuth.
- a specific piece of soft- or hardware managing the identity
- a specific protocol to establish/claim an identity to a web server/service
- an intermediate public key, derived from the master key
- the intermediate public key is unique to a domain name, thus providing privacy against other servers/services on other domains
- a changing challenge/nonce for each authentication attempt, to mitigate against replay attacks.
So, with this, is there a significant difference I did not spot yet?
Note: This is not about usability or specific implementations of it (clients or server components, but more about the architecture.
Resources for FIDO2
- https://fidoalliance.org/specs/fido-uaf-v1.1-ps-20170202/fido-uaf-overview-v1.1-ps-20170202.pdf (Spec)
Resources for SQRL