A passkey is a passwordless credential built from a public–private key pair. During registration, a service stores the public key; during login, the holder signs a unique challenge with the private key, proving possession without revealing the secret. section 3.6.4
This challenge–response design prevents replay: an intercepted response cannot be reused. Passkeys are also phishing resistant because the private key remains with the credential holder. WebAuthn connects them to browsers and JavaScript applications. section 3.6.4
Passkeys combine strong protection with practical deployment characteristics:
- They avoid passwords and do not require users to copy one-time codes between applications. section 3.7.2
- They resist phishing and MFA fatigue more effectively than passwords, SMS codes, authenticator codes, and push notifications. section 3.7.2
- The main operational risks are lost devices with weak security and malware that exposes the key store. section 3.7.2
- Users may still find passkeys unfamiliar, even as major online services deploy them as an authentication option. section 3.6.4
Signing a login challenge
Alice registers an identifier and public key. At login, the service sends a fresh challenge; Alice signs it with her private key, and the service verifies the signature using the stored public key. section 3.6.4
Figure 3.8 Challenge–response authentication flow using public-key cryptography. Alice registers by providing an identifier and a public key. At login, the service sends a challenge, which Alice signs with her private key. The service verifies the signature using the stored public key, confirming heridentity without exposing the private key. This method offers strong resistance to phishing and replay attacks.
Trace registration, challenge signing, and public-key verification in the challenge–response authentication flow. section 3.6.4
