Passkeys
Passkeys are password-free credentials based on asymmetric cryptography following the FIDO and WebAuthn standards and bound to a specific website.
With a passkey, the device creates a key pair for exactly one website. The private key stays on the device or in the password manager; the website stores only the public key. At sign-in, the device signs a challenge from the website after the person has identified themselves with a fingerprint, face recognition or device PIN. Because the passkey is bound to the domain, it does not work on a fake site.
For agents, passkeys are the secure way for a person to confirm a mandate. The agent itself should never receive its principal's passkey: it gets its own mandate with limits instead of her full sign-in.
Example
A customer sets up a mandate up to CHF 200 for her shopping agent and confirms it with her smartphone's passkey. The agent receives only the mandate, not her access to the account. If it wants to spend more, she must confirm again.
How it differs
A passkey proves that a person is signing in; a mandate proves what her agent may do afterwards. Strong customer authentication in payments can be fulfilled with passkeys but concerns payments, not agents' authority.
In practice
- Have mandates confirmed with a passkey instead of giving agents credentials.
- Never give an agent its principal's passkey or password.
- Require a fresh confirmation for extensions of a mandate.
Role in KYA
KYA does not verify passkey sign-ins. A mandate whose issuance was confirmed with a passkey has a stronger origin, however; KYA then verifies the mandate itself.
Related check: Agent and principal (subject_agent_binding). Do all parts name the same agent, is the principal named, does the agent hold the bound key?
Frequently asked questions
What are passkeys?
Password-free credentials based on a key pair. The private key stays with the user; the website knows only the public one.
Why are passkeys more secure than passwords?
They cannot be guessed or stolen in data leaks and work only on the website they were created for. Phishing therefore fails.
Should an agent receive a passkey?
No. With the passkey, the agent would have all of the person's rights. It is better to give it its own mandate with limits.
How do passkeys relate to mandates?
A person can confirm the issuance of a mandate with her passkey. This proves that she gave the instruction herself.
Which standards are passkeys based on?
On the FIDO Alliance standards and the W3C's WebAuthn, which browsers and operating systems widely support.