PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to login (biometrics login ?) which many of the banking and other applications already support (ex: 1Password).
For PassKeys, this is my understanding:
- involves PKI;
- private key stored in the device's key chain
- public key stored on server
- during login, server sends challenge encrypted with the public key
- client side access the device's key-chain using the biometrics data (touch-id, face-id), signs the challenge and responds to server
- login succeeds
How does login with touch-id works and what sort of keys & secrets are stored and where?