TUSH-Key: Transferable User Secrets on Hardware Key

Passwordless authentication has revolutionized secure merchant payments, discarding reliance on passwords and PINs. Utilizing W3C Web Authentication (WebAuthn) and Client to Authenticator Protocol (CTAP), it employed public key cryptography to uniquely verify a user’s device and identity, constituting the FIDO authentication standard. Its growing popularity prompts widespread adoption, yet device attestation ties it to a specific device, hindering user flexibility. FIDO Passkeys attempt to address this by synchronizing cryptographic keys, enabling passwordless authentication from any device. However, Passkeys face challenges like proprietary encryption algorithms, reliance on specific cloud providers, and suboptimal cross-platform key synchronization. To overcome these limitations, this paper introduces a novel private key management system—Transferable User Secret on Hardware Key (TUSH-Key). TUSH-Key facilitates seamless, cross-platform synchronization for passwordless logins, aligning with FIDO2 specifications, thereby addressing the drawbacks of FIDO Passkeys.