Everything about Passkey

Upstate1618

I wanna write a post to discuss everything about passkey, WebAuthn and so on.

What's WebAuthn, FIDO2, U2F or CTAP?
FIDO2=WebAuthn+CTAP1/CTAP2/U2F
(https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/fido2_building_blocks.png)
What's the types of authenticators?
The WebAuthn standard supports two types of authenticator modalities: Platform(TPM, Titan chip or Secure Enclave) and cross-platform(Yubikey, Google Password Manager, KeyChain or Bitwarden) authenticators.
What's the types of Credentials?
Credentials are on your authenticator. There are 2 types of credentials: Discoverable and non-discoverable. “Discoverable” refers to the ability for a relying party(Google, Microsoft or Proton) to attempt to utilize a credential on an authenticator without the user providing a user handle(your username/email). Passkeys are Discoverable. For example, you can login Github using your passkey without typing your email. “non-Discoverable” means you must type your email before using the credential. It can be used as 2FA along with your password.
Credential can also be divided into Single device credentials (SDC) and Multi device passkeys (MDC). Credentials on TPM, Titan, Yubikey or Secure Enclave are SDC. They cannot be moved or synced. Credentials on Bitwarden, Google Password Manager or Keychain are MDC. SDC are more secure.
Is Passkey a form of 2FA?
Not always. Passkeys can be 1/2/MFA. This is controlled by relying party(Google, Microsoft or Proton). In the demo, you can create a 1FA passkey on your Yubikey by setting Advanced Settings-Authentication Settings-User Verification=Discouraged. If an other person have your Yubikey, they can access your account even if they do not know your Yubikey PIN.
Whats the case on GrapheneOS?
Non-discoverable Credential are supported in AOSP. You can use Titan chip, Yubikey etc. as authenticators. You cannot use Bitwarden/Google Password Manager for this.
Discoverable Credential(Passkeys) are supported through Google Play. You can only use logged-in GPM or third party password managers like Bitwarden as authenticators when creating Passkeys. You can use GPM/Bitwarden/Yubikey as authenticators when using Passkeys.
You can manage Passkeys in GPM(Settings-Apps-Google Play services app info-all services-Security-Password Manager)/Bitwarden etc. You cannot manage Non-discoverable Credential.
What's the case with Windows/Yubikey?
You can [manage](ms-settings:savedpasskeys) your credentials on Winsows. You can only manage your Discoverable Credential on Yubikey using ykman.
Learn More

fid02

You can also manage the passkeys on your Yubikey on Android by using the Yubico Authenticator app:
https://play.google.com/store/apps/details?id=com.yubico.yubioath
https://github.com/Yubico/yubioath-flutter

DeletedUser24

fid02

Does the Android app (for passkey) work with all keys, or just the new 5.7 ones?

fid02

DeletedUser24 Works fine for me on a Yubikey Security Key series firmware version 5.4. Can view and delete passkeys.

DeletedUser24

fid02

I was going to buy the new keys almost just for that, thanks for saving me money.

Glido

Does anyone knows if graphene os supports security standard FIDO CTAP 2.1?

fid02

Glido Does anyone knows if graphene os supports security standard FIDO CTAP 2.1?

As far as I can tell, the features of CTAP2.1 work perfectly fine on GrapheneOS. The Android Open Source Project (AOSP) and GrapheneOS does not have native support for FIDO standards, and apps will have to use a FIDO library for that. Google Play services has FIDO and CTAP support and most apps choose to use Play's FIDO library instead of an alternative one. An example of an open source app not relying on Play services is Yubico Authenticator. A major feature of CTAP2.1 vs. 2.0 is that you can manage (view a list of and delete) passkeys without the security key needing custom firmware for that. I have a few keys by Token2 which support CTAP2.1 and I can manage the passkeys stored on them by using Yubico Authenticator.

Which features of CTAP2.1 are you specifically wondering about?

Glido

Hi Fid02

Thank you for sharing your experiences. I bought a security key and installed it.
When I connect the key with my Graphene phone I get the message "17: API: Fido.FIDO02_API is not available on this device. Connection failed with: ConnectionResult(statusCode=SERVICE_INVALID,resolution=null, message=null)".

I want to use it for my cloud service app from Proton.

Do you have any idea how I could use security keys for proton apps instead of fingerprint?

fid02

Glido 17: API: Fido.FIDO02_API is not available on this device. Connection failed with: ConnectionResult(statusCode=SERVICE_INVALID,resolution=null, message=null)

That's the message you receive when you try to use your security key with one of Proton's apps? Think it indicates that it's not detecting Google Play services. Is Play services installed in that profile you are trying to use the security key?