Sites using passkeys?

No. A pass-key is a public-key encryption pair. You upload your public key to the site with your account. Authentication is done using the key pair. I don’t know exactly what Passkey is doing, but these algorithms typically involve the remote server sending you some challenge data encrypted with your public key. Your browser then decrypts it (with a locally-stored private key), performs some operation on the data and encrypts the result with your private key before returning it. The server then decrypts the response with your public key and compares the result against the expected result. If the public and private keys don’t match, it doesn’t get the expected result and access is denied.

Conceptually, it seems to me like something very similar to SSH’s key-pair authentication.

Apple will be storing passkeys (both public and private keys, I assume) locally in your keychain. If you enable iCloud keychain sync, then your other Apple devices will also get them. If not, then they will remain local.

2 Likes