Comment on Support PassKey Integration (Web Authentication API) in KeePassXC implemented

• shortwavesurfer@monero.town ⁨11⁩ ⁨months⁩ ago

  When you sign up, your device creates a public private key pair. It keeps the private key locally and sends the public key to the server. So instead of a username, you are nothing but a string of random characters representing your public key. You can see an example of this, if you go into the Linux terminal and type “ssh-keygen”

  source

  • zerodawn@leaf.dance ⁨11⁩ ⁨months⁩ ago

    Underrated explanation, you held it finally click for me. I consider myself a fairly educated person but just couldn’t wrap my head around what made it so special. Correct me if i’m wrong but my understanding is the server uses the public key to encrypt a challenge code that can only be decrypted by your private key. You get an on device prompt to approve the process and the rest is done under the hood.

    To go further on this, is the public/private key a mathematical relationship? What ties the two together to make them useful as a pair?

    source

    • SandboxScience@feddit.de ⁨11⁩ ⁨months⁩ ago

      Also no expert about the math behind it but this is how I learned asymmetric encryption with public and private key on a very high level of abstraction:

      To encrypt a message you basically take the unencrypted message to the power of the private key (lets call that d) and divide it by the result of a multiplication of two large prime numbers (lets call that N). Now you take the rest of that division, so basically modulo if you are familiar with that.

      To decrypt, you take the encrypted message to the power of the public key (e) and divide it by N. The rest of that operation is again the unencrypted message.

      So the private and public key are the pairs (d, N) and (e, N) respectively. The great thing about this is that you can post the public key publicly without care and only you, in possession of the private key, can decrypt messages encrypted with your public key. So its easy to verify if you got the key but hard to brute force due to modulo being a one way function. However, this basic RSA approach as described here is not used on its own anymore but rather in combination with other techniques to prevent guessing on very short messages or keys.

      source
    • shortwavesurfer@monero.town ⁨11⁩ ⁨months⁩ ago

      You got it. You authenticate with your biometrics. The server sends you a challenge. Your device decrypts that challenge locally and sends the server the response back. As for the mathematics behind it all, I am not the person to ask. I just know that it does work, and that quantum computers could be a serious problem in the future. But for now, they’re not.

      source
  • lemmyvore@feddit.nl ⁨11⁩ ⁨months⁩ ago

    [deleted]

    source

    • shortwavesurfer@monero.town ⁨11⁩ ⁨months⁩ ago

      No, because they wouldnt be able to send you a challenge and you solve the challenhe.

      source
    • farcaller@fstab.sh ⁨11⁩ ⁨months⁩ ago

      With public keys the attacker can encrypt the message for you, but only you can decrypt it, still.

      source
  • cole@lemdro.id ⁨11⁩ ⁨months⁩ ago

    good explanation, thank you! I’m very familiar with ssh key auth so that makes sense

    source