PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to login (biometrics login ?) which many of the banking and other applications already support (ex: 1Password).

For PassKeys, this is my understanding:

  • involves PKI;
  • private key stored in the device's key chain
  • public key stored on server
  • during login, server sends challenge encrypted with the public key
  • client side access the device's key-chain using the biometrics data (touch-id, face-id), signs the challenge and responds to server
  • login succeeds

How does login with touch-id works and what sort of keys & secrets are stored and where?


You must log in to answer this question.

Browse other questions tagged .