189 VIEWS
Pinterest LinkedIn LINE

At OpenID Summit 2024 (2024-01-19), @ritou gave a talk; this is a summary.

Overview:

This document provides an overview of the relationship between passkeys and identity federation, their respective characteristics, how they complement each other, and related specifications, based on Mr. Ito’s presentation materials at OpenID Summit Tokyo 2024. It focuses in particular on the benefits gained by introducing passkeys into identity federation, how identity federation may compensate for areas where passkeys are weak, and the relevant technical specifications.

Key themes:

  1. Characteristics of passkeys and identity federation:
  • Passkeys: Characterized by security and convenience. They use public-key cryptography and offer strong phishing resistance. Convenience is improved through local authentication using biometrics or a passcode, as well as synchronization through password managers. However, challenges remain with account recovery, such as losing all devices or a security key, and with synchronization across platforms.
  • Identity federation (OpenID Connect): An authentication method used for social login. It can be used not only for authentication but also for identity proofing, such as verifying an email address or a person’s identity. Because it uses basic browser mechanisms, it is supported across a wide range of environments. It is highly extensible, and extension specifications and profiles have been developed for various use cases. On the other hand, it is difficult to achieve a UX that goes beyond browser constraints, and sharing authentication state between services presents challenges. Account matching issues and problems originating with the identity provider must also be considered.
    • “Passkeys are often said to have 2 characteristics: security and convenience. First, they are an authentication method that uses public-key cryptography. Also, because a browser acts as an intermediary, they have a level of phishing resistance that differs from previous authentication methods. Convenience is also high because they use local authentication, such as biometrics used for screen locks or pattern authentication.”
    • “OpenID Connect has reached its 10th anniversary, and as shown in the morning session, because it can be implemented using basic browser mechanisms, it is supported in an extremely wide range of environments.”

2. Benefits of passkeys in identity federation and their complementary relationship:

    • Passkeys compensate for weaknesses in identity federation: Improved UX, broader adoption among users who dislike identity federation, and stronger security. The browser-mediated mechanism makes it easier to understand which service the user is logged in to. Management by a password manager reduces privacy risks.
    • Identity federation compensates for weaknesses in passkeys: Support for unsupported environments. Identity providers can build a robust authentication foundation by supporting various authentication methods, including passkeys. They can also support account recovery when a passkey is lost.
      • “Passkeys can be used in ways that compensate for the weaknesses of identity federation. This can improve the user experience (UX) and accommodate people who are reluctant to use identity federation. Conversely, there may also be an aspect in which identity federation reinforces the weaknesses of passkeys.”

    3. Related specifications:

      • OpenID Connect extensions: The authentication strength (such as requiring passkey authentication) can be specified using the acr_values parameter in an authentication request. The authentication method can be identified through the amr claim. The max_age parameter can be used when reauthentication is required.
      • OAuth 2.0 Step-up Authentication Challenge Protocol: Provides a mechanism for a resource server (API) to require the relying party to reauthenticate when the authentication strength of the access attempt is insufficient.
        • Parameters that can be used in an authentication request are defined. ACR (Authentication Context Class Reference) means a reference to the authentication context, while AMR (Authentication Methods Reference) refers to the authentication method. Using the 2th request at the bottom makes it possible to specify users with a particular authentication strength, such as “users who authenticated with a passkey,” or another specific authentication method.
        • The following scenario is an example of the OAuth 2.0 Step-up Authentication Challenge Protocol. For example, a user who authenticated with a password attempts to use a payment service application, but is judged not to meet its security policy.
        • In such a situation, additional authentication is required for reasons such as “the ACR value is insufficient” or “this authentication method is insufficient.” For example:
          • The authentication level is insufficient
          • A specific authentication method is required
          • Reauthentication is required because a certain period (3 days in this example) has passed since authentication
        • When these conditions are not met, the system can return an error and require authentication at a higher security level.

      Conclusion:

      Passkeys and identity federation have different characteristics, but by complementing each other they can create a more secure and convenient authentication foundation. In particular, introducing passkeys into an identity federation system offers various benefits, including improved UX, stronger security, and support for unsupported environments. By understanding and using related specifications such as OpenID Connect extensions and the OAuth 2.0 Step-up Authentication Challenge Protocol, developers can maximize the benefits of passkeys. Convert to convert_to_text source

      Watch this video on YouTube.
      Playing the video connects to YouTube.

      Introduction

      • Speaker: ritou, affiliated with mixi
      • Topic: The relationship between passkeys and identity federation

      Characteristics of passkeys

      • Provide both security and convenience
      • An authentication method using public-key cryptography
      • Achieve phishing resistance through browser mediation
      • Use biometrics and other methods employed for screen locks
      • Passkey synchronization through password managers

      Challenges with passkeys

      • Account recovery after losing all synchronized devices
      • Problems when a security key is lost
      • Challenges with cross-platform synchronization between different ecosystems (Apple, Google, Microsoft)
      • True cross-platform support requires an external password manager

      Current state of passkey implementation

      • 2023: Sites add passkey support alongside existing authentication methods
      • 2024: Focus on registering new users directly with passkeys, without passwords
      • Migration strategies from passwords to passkey authentication become important

      Characteristics of identity federation (OpenID Connect)

      • OpenID Connect has reached its 10th anniversary
      • Uses basic browser mechanisms for broad compatibility
      • Highly extensible, with working groups developing extensions for various use cases
      • Profiles created to standardize implementation patterns

      Challenges with identity federation

      • Limits on the user experience due to browser constraints
      • Difficulty in easily determining authentication state across services (cross-domain challenges)
      • Some implementations depend on third-party cookies
      • Account matching issues between identity providers and relying parties
      • Risks from identity provider service outages or account suspension
      • Uneven implementation of the OpenID Connect specification

      Comparison of authentication methods

      • Passkeys provide an excellent UX by displaying available credentials through the browser’s autofill feature
      • Password managers that manage passkeys offer privacy benefits because they do not share service usage patterns
      • Passkeys provide a clear consent mechanism and user verification for reauthentication
      • Depending on the implementation, identity federation systems may lack reauthentication capabilities

      Complementary relationship

      • Passkeys can compensate for weaknesses in identity federation:
        • Improved UX
        • Appeal to users who do not prefer identity federation
      • Identity federation can reinforce weaknesses in passkeys:
        • Identity providers support multiple authentication methods
        • Support in environments that do not support passkeys
        • Identity providers with verification systems have extensive account recovery options

      Technical features of OpenID Connect

      • Specific authentication methods can be requested using Authentication Context Class Reference (ACR) values
      • Authentication methods can be specified with the Authentication Methods Reference (AMR) parameter
      • The core specification includes reauthentication parameters:
        • max_age: Maximum elapsed time since user authentication
        • login_hint: Helps identify the correct user account
        • id_token_hint: Ensures user consistency

      Advanced features

      • The FAPI (Financial-grade API) authentication profile supports phishing resistance and hardware-protected credentials
      • AMR values defined in RFC 8176 support various authentication methods, including public-key cryptography
      • OAuth 2.0 Step-up Authentication Challenge Protocol (RFC 9470):
        • Extends security requirements to resource servers (APIs)
        • Enables policies that require stronger authentication for sensitive operations
        • Can reject requests with insufficient authentication strength
        • Supports reauthentication requests to meet security requirements

      Application to modern architectures

      • Applicable to internal IAM systems
      • Identity provider platforms authenticate SPAs and native apps (relying parties)
      • Resource servers (payment services, healthcare microservices, and others) can enforce authentication requirements

      Conclusion

      • Passkeys and identity federation have different characteristics but can be used in combination
      • They can compensate for each other’s weaknesses
      • The OpenID Connect specification already supports many of the features needed for secure authentication
      • Combining these technologies can bring the benefits of passkeys to identity federation systems

      Related posts