Extending Passkeys: Using Authentication Technology as Cryptographic Seed Material
By
csuwldcat
Slow-proofed and worth the wait. Worth its weight in flour.
Summary
The article explores how Passkeys, originally designed for website/app authentication, can be repurposed as cryptographic seed material for broader cryptographic use cases. The author, who worked on Microsoft's Passkeys team, discovered that Passkeys' properties and behaviors can be 'hijacked' to enable new applications while maintaining their benefits of cross-device syncing and biometric user experience. The piece represents a technical exploration of extending Passkeys beyond their intended authentication purpose to address new cryptographic needs.
Key quotes
· 4 pulledPasskeys have made standard, secure, cryptographic authentication accessible to all users, but the model is tightly restricted to website/app login.
Even with a deep, code-level understanding of passkeys and WebAuthn, it wasn't until now, six years later, that I realized a set of properties and behaviors present within Passkeys could be hijacked to make this post possible.
This 'feature' was sitting right there and feels so obvious in retrospect.
An exploration in using Passkeys as generalized cryptographic seed material to address new use cases, while inheriting the benefits of cross-device synced keys with native biometric UX.
You might also wanna read
Threshold Signatures: Distributing Cryptographic Risk to Eliminate Single Points of Failure
The article discusses the security risks of single private keys as points of failure in cryptographic systems and introduces threshold signa
eric.mann.blog·2mo ago
Multiple Security Vulnerabilities Discovered in GnuPG and PGP Implementations
A developer (reaper) apologizes for forgetting the source code for a website while leaving, forcing a complete rewrite. The article lists mu
gpg.fail·5mo ago
Anthropic Releases Free Security Plugin for Claude Code Terminal to Detect Vulnerabilities
Anthropic has released a free security-guidance plugin for its Claude Code terminal tool that autonomously reviews code edits, model outputs
cybersecuritynews.com·4h ago
wolfCOSE: A Lightweight COSE + CBOR Library for Embedded Systems with PQC and FIPS 140-3 Support
wolfCOSE is a lightweight C library implementing CBOR (RFC 8949) and COSE (RFC 9052/9053) for embedded systems, using wolfSSL as the crypto
github.com·1d ago
Anthropic launches Claude Security beta for codebase vulnerability scanning
Anthropic has released Claude Security, a defensive security tool within Claude Code on the web, from closed preview to beta for Claude Ente
thenewstack.io·1d ago
How LinkedIn's 2012 Breach Exposed the Dangers of Unsalted Password Hashes
This article examines the 2012 LinkedIn breach where attackers cracked millions of passwords using fast, unsalted hashes like MD5 and SHA-1.
hendryadrian.com·1d ago