I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme.

Both seem to use the same key elements:

  • a private, user-resident "master key" thus not relying on a 3rd party like OAuth.
  • a specific piece of soft- or hardware managing the identity
  • a specific protocol to establish/claim an identity to a web server/service
  • an intermediate public key, derived from the master key
  • the intermediate public key is unique to a domain name, thus providing privacy against other servers/services on other domains
  • a changing challenge/nonce for each authentication attempt, to mitigate against replay attacks.

So, with this, is there a significant difference I did not spot yet?

Note: This is not about usability or specific implementations of it (clients or server components, but more about the architecture.

Resources for FIDO2

Resources for SQRL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.