7

According to different pages (e.g. OneIdentity, also a Google Security source I can't find anymore), using Passkeys does count as Multi Faktor Authentication. To my understanding, they argue, that the User needs

  1. the device,
  2. and needs to be able to unlock the key on the device, e.g. by using biometrics or a PIN.

So 2 factors, therefore MFA.

But still, the server only needs to validate one factor - the response sent after the challenge of the server. So for the server, it is not possible to verify, whether the user really needed two factors, or whether the private key was maybe in an unsecured location, and therefore it was only single factor.

I see this especially in contrast to methods using OTP as 2nd factor, where the server might get username+password and the OTP, and can verify both factors on the server side.

Is there any specification going into more detail, whether passkeys can also be considered as MFA and why? Or is there another term for something passkeys is trying to achieve here? (like "Client-side MFA"? :-) )

2

3 Answers 3

8

We get variants on this question quite a lot. The key factor here is that it's multi-factor authentication. Therefore, you need to have multi-factors of authentication for it to be MFA.

The underlying question is, who's the authenticator? If the authenticator is authenticating multiple factors, then it's MFA.

In a passkey situation, it's not the service that's doing the authenticating, it's your device. And if your device is doing the authenticating and it's authenticating multiple factors, it could be MFA, depending on the implementation.

This is in contrast to something like chained factors, where you have one factor that unlocks another factor, which is then authenticated. And that's a different scenario altogether.

Or, where you try to claim the authentication service itself is an authentication factor, which isn't a factor for the authentication system.

So with many passkey implementations, you have the authentication of the device to unlock the key that is sent to the remote service, often through biometrics. And possibly the authentication to unlock the device. And from that angle, it's not MFA, because there is only one authentication factor in each link in the chain of authenticators.

However, one can say that passkeys are more secure than MFA because of its local authentication and the existence of the chain. But at this point, you can't apply some term that involves "MFA" (unless it is). The term is "Passkey".

5
  • 1
    Having the device is also an authentication factor. So device + biometrics (or device + PIN) gives two factors, which would be MFA.
    – JBYoshi
    Commented Jun 22 at 17:32
  • @JBYoshi and I explain how it is not ... If that was true, then a password as a single factor magically becomes MFA ...
    – schroeder
    Commented Jun 22 at 19:59
  • I'm understanding the "chained factors" you talk about as a scenario where "the password unlocks the device, which unlocks the account". However, simply knowing the password doesn't mean you can control the device where the passkey's private key is stored, unless you also have physical access to the device to enter that password. In contrast, a website account that just has a password only requires access to the website, and in most security models it's assumed that the website is accessible by anyone.
    – JBYoshi
    Commented Jun 22 at 20:31
  • 1
    Thanks @schroeder for the great reply! You mentioned it comes down to whether the authenticator authenticates two factors. I noticed FIDO talks a lot about "authenticators" like hardware keys or phones. If this is where authentication is done, it would be MFA according to your explanation. But how can a hardware key, under my full control, be the authenticator for a remote web service? I expected the authenticator to decide "auth successful" or "auth unsuccessful" and forward this decision to the server. However, it seems this decision is rather made by the remote service. Or am I wrong here? Commented Jun 25 at 19:12
  • 2
    @user3921232 pingidentity.com/en/resources/identity-fundamentals/… FIDO is many protocols. UAF not MFA. U2F is. FIDO2 can be if configured to be.
    – schroeder
    Commented Jun 25 at 19:41
2

The server only validates the cryptographic response, not the individual factors, which relies on the device's security to ensure the biometric/PIN factor remains secure.

This is what I said in my comment- that the factor that makes Passkeys borderline MFA or not is because whether the device is jail broken, rooted, or has malware etc, is out of the server’s control. I think this is why Google and other organisations don’t ‘trust’ it as much as common methods.

So yes, this concept is called "Client-side MFA" since multiple factors are verified on the client before generating a server response. Also, the FIDO Alliance and WebAuth specifications support this security model.

Regulatory guidelines like NIST SP 800-63 also recognize the high security of Passkey MFA, because most of the time secure enclaves and such are secure and will remain secure.

1

To make things a bit clearer, let's regard this from an attacker's point of view. This assumes a typical Passkey implementation on a smartphone.

An attacker might steal the phone and bypass or break the authentication. Your fingerprint is not a secure password; you leave it everywhere. And apart from the good old gummi bear attack, there are newer approaches like BrutePrint.

However, BrutePrint should no longer work on recent smartphones (it's now mandatory for Android 10+ phones to implement a "secure pipeline", which should prevent injection of fingerprint data into the Application Processor Trusted Execution Environment; I think that's a requirement [C-2-8] for biometric sensors).

Regardless, there are ways to temporarily incapacitate the target person, for example through an attack vector known as a "Mickey Finn".

A traditional MFA would require the target person to voluntarily supply a secret. With Passkey, this is not required.

Technically, it's still MFA(*), but one of the factors is so weak that it doesn't improve security significantly over 1FA.

(*) The factors are Possession ("what you have") and Inherent Qualities ("what you are").

5
  • 1
    Solid answer but most of the time it is very, very hard to break into the secure enclave in an un-compromised device such as an iPhone. Commented Jun 22 at 12:02
  • 1
    You don't explain why it is MFA. You just make an assertion.
    – schroeder
    Commented Jun 22 at 12:21
  • 1
    Please make sure that you include links to non-standard terminology.
    – schroeder
    Commented Jun 22 at 12:25
  • True, the iPhone didn't have the weakness as some Android phones, but it's still easy to access a secured iPhone. Like a stage magician can "force a card" ("pick any card you want", you pick exactly the card the magician wants you to pick), a pen test target will hand over the iPhone, voluntarily, but without consciously noting the fact. That the fingerprints on the display are usually not good (but might reveal a swipe pattern or the digits of an unlock code), so you'll need to invite the target to a latte macchiato for better prints. Drugging or seduction are not part of a pen test!
    – Klaws
    Commented Jun 28 at 16:00
  • @schroeder Thank you!
    – Klaws
    Commented Jun 28 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .