THE CRYPTOGRAPHY BEHIND PASSKEYS

Summary from the TLDR InfoSec newsletter

Passkeys employ public-key cryptography for authentication. The user's device creates a digital signature with a private key, while the website verifies it using a public key, reducing password vulnerabilities. WebAuthn provides vital anti-phishing protections through origin binding, ensuring passkeys are functional only with their respective websites. Different authenticator types balance security and convenience. The passkey ecosystem supports cryptographic extensions for functionalities such as key derivation and secure storage. However, developers must implement account recovery mechanisms, as lost passkeys cannot be reconstructed.