I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme.

Both seem to use the same key elements:

  • a private, user-resident "master key" thus not relying on a 3rd party like OAuth.
  • a specific piece of soft- or hardware managing the identity
  • a specific protocol to establish/claim an identity to a web server/service
  • an intermediate public key, derived from the master key
  • the intermediate public key is unique to a domain name, thus providing privacy against other servers/services on other domains
  • a changing challenge/nonce for each authentication attempt, to mitigate against replay attacks.

So, with this, is there a significant difference I did not spot yet?

Note: This is not about usability or specific implementations of it (clients or server components, but more about the architecture.

Resources for FIDO2

Resources for SQRL

  • Gained any insight in the meanwhile? – Senkaku Oct 29 '20 at 15:19
  • @Senkaku No, but I did not investigate further. I was curious at the time, but still do not use any of them today. – Marcel Oct 30 '20 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.