Hardware Authenticator Binding: A Secure Alternative to Passkeys

Fast Identity Online 2 (FIDO2) employs public-key authentication to mitigate the weaknesses of password-based authentication. FIDO2 traditionally assumes that credentials are non-exportable and bound to hardware authenticators for strong security. However, modern users increasingly demand credential sharing across devices for better usability. Passkeys offer a choice between synchronized and device-bound credentials, but this creates a trade-off between usability and security. We propose a hardware authenticator binding (HAB) scheme that enables virtual synchronization of device-bound FIDO2 credentials, achieving the best of both worlds. A user-selectable, cloud-based HAB service manages authenticator binding, facilitating hardware authenticator registration, revocation, and recovery in case of loss. To ensure security, the HAB service incorporates decentralized key management, unlinkability through binding certificates, and attestability via trusted execution environments. We implemented the HAB service using AMD SEV-SNP, leveraging the virtual machine privilege level for trusted attestation. Our security analysis and performance evaluation demonstrate the feasibility of the HAB scheme.