Comment by BoppreH
7 days ago
Nope! You could have one "master recovery key", the public part loaded on your device (to be registered during account creation) and the private part sitting in your safe. Or even a number of pre-generated recovery keys. You could also give those keys a higher "priority", since they're offline, so that they can revoke lesser keys in case of account compromise.
I proposed a protocol with this feature almost a decade ago: https://www.researchgate.net/publication/343318317_Privacy-a...
The problem is that the passkey protocol prevents you from adding a (additional) key you don't currently control. This is what crote was referencing here:
> Passkeys have to be online to enroll additional keys, so any kind of software or smartphone solution is going to depend completely on cloud sync.
> You could have one "master recovery key", the public part loaded on your device (to be registered during account creation) and the private part sitting in your safe.
This is true, it's possible to have just the verification information present without the key itself.
However, a part of almost every credential enrollment process is verification that the credential is usable and controlled by the enrolling party.
For passwords it's simply "please type the password again", for TOTP it's generating the next number, for email/SMS it's entering a code sent to that address, so for adding a public key, it should include some way of verifying that you control the private key associated with that public key. It's hard to do that without having the private key available.
> For passwords it's simply "please type the password again", for TOTP it's generating the next number, for email/SMS it's entering a code sent to that address
Those are strings typed by humans and frequent victims of typos, so the need is much higher. But you're right that it's still useful to prevent a user from accidentally using a bad key, or from selecting a maliciously formatted public key to mess with the protocol. I just don't think these benefits outweigh the lost ability of making offline backups.
Maybe allowing registration of multiple keys, but only requiring proof of possession of one key would be a good compromise.
> but only requiring proof of possession of one key would be a good compromise.
Prove that you possess one key, and sign the other public keys with that key you possess? That would prove that you possess the public keys, wouldn't it?
I guess my concern would be that I have the public key to my backup Yubikey on my computer, I enroll it everywhere but I never actually use the Yubikey because it is stored in a vault at the bank. Nothing prevents an attacker from replacing my public key with theirs, and suddenly I'm enrolling them everywhere without ever noticing.
Or am I missing something?
1 reply →
I actually do something like this with PGP: I have my master key stored securely somewhere, and I load subkeys on my Yubikeys.
Would be cool if I could do that with FIDO2!