Improve guidance for passkey implementations in Authentication Cheat … by YK-03 · Pull Request #2052 · OWASP/CheatSheetSeries

YK-03 · 2026-03-05T11:27:05Z

You're A Rockstar

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

In case of a new Cheat Sheet, you have used the Cheat Sheet template.
All the markdown files do not raise any validation policy violation, see the policy.
All the markdown files follow these format rules.
All your assets are stored in the assets folder.
All the images used are in the PNG format.
Any references to websites have been formatted as [TEXT](URL)
You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
The CI build of your PR pass, see the build status here.

Description

This PR improves the guidance in the FIDO2 / Passkeys section of the Authentication Cheat Sheet by recommending the use of well-maintained WebAuthn libraries or platform APIs instead of implementing authentication logic manually.

A reference link to the Web Authentication API (WebAuthn) documentation was also added to provide developers with an authoritative resource for implementing passkey-based authentication securely.

AI Tool Usage Disclosure (required for all PRs)

I have NOT used any AI tool to generate the contents of this PR.
I have used AI tools to assist with drafting and formatting this contribution. The contents were reviewed and validated before submission.

Thank you again for your contribution 😃

…Sheet

jmanico · 2026-03-06T05:28:31Z

minor lint errors: cheatsheets/Authentication_Cheat_Sheet.md:350 MD012/no-multiple-blanks Multiple consecutive blank lines [Expected: 1; Actual: 2]

mackowski · 2026-03-15T17:55:27Z

@jmanico please review this one too ;-)

jmanico

This is missing that the core control to passkey is the clients underlying default key manager like a TPM for windows or iOS Secure Enclave. I think this is an important missing factor.

YK-03 · 2026-03-16T05:25:05Z

The role of the client’s underlying key manager (e.g., TPM on Windows or Secure Enclave on Apple devices) is indeed an important part of the passkey security model. I’ll update the guidance to explicitly mention these hardware-backed key stores so the explanation is clearer and more complete.

…ure Enclave, Android Keystore)

Copilot

Pull request overview

This PR updates the Authentication Cheat Sheet’s passkey/FIDO2 guidance and cleans up a Markdown table, aiming to improve clarity around automated attack types and passkey key storage properties.

Changes:

Reformats the “Protect Against Automated Attacks” table to standard Markdown table syntax.
Expands the FIDO2/Passkeys subsection with a new “Hardware-backed Key Storage” subsection and revised FIDO2 wording.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T10:13:40Z

cheatsheets/Authentication_Cheat_Sheet.md

+**FIDO2**: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern **Passkeys** technology. Passkeys enable users to securely log in using local user verification (such as biometrics or device PINs), often with credential synchronization across devices.
+
+#### Hardware-backed Key Storage


The PR description mentions adding a reference link to the Web Authentication API docs and recommending using well-maintained WebAuthn libraries/platform APIs, but this change only adds a new subsection and contains no such link or guidance. Either update this section to include the described recommendations/link, or adjust the PR description to match the actual changes.

Copilot · 2026-03-26T10:13:40Z

cheatsheets/Authentication_Cheat_Sheet.md

+**FIDO2**: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern **Passkeys** technology. Passkeys enable users to securely log in using local user verification (such as biometrics or device PINs), often with credential synchronization across devices.
+
+#### Hardware-backed Key Storage
+
+For platform passkeys, the private key is generated and stored by the operating system's secure key manager. Modern platforms typically provide hardware-backed protection for these keys, such as the Trusted Platform Module (TPM) on Windows, Secure Enclave on Apple devices, or the Android Keystore/StrongBox on Android.
+
+The private key is non-exportable and remains on the user’s device. During authentication, the platform security module signs a server challenge using this key. This hardware-backed protection of private keys is a core security property of passkeys and WebAuthn.


Line 344 states passkeys often have credential synchronization across devices, but line 350 then states the private key "remains on the user’s device". These statements conflict for synced passkeys; please reword to distinguish device-bound vs synced passkeys (and avoid implying the private key never leaves a device in all cases).

Suggested change

**FIDO2**: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern **Passkeys** technology. Passkeys enable users to securely log in using local user verification (such as biometrics or device PINs), often with credential synchronization across devices.

#### Hardware-backed Key Storage

For platform passkeys, the private key is generated and stored by the operating system's secure key manager. Modern platforms typically provide hardware-backed protection for these keys, such as the Trusted Platform Module (TPM) on Windows, Secure Enclave on Apple devices, or the Android Keystore/StrongBox on Android.

The private key is non-exportable and remains on the user’s device. During authentication, the platform security module signs a server challenge using this key. This hardware-backed protection of private keys is a core security property of passkeys and WebAuthn.

**FIDO2**: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern **Passkeys** technology. Passkeys enable users to securely log in using local user verification (such as biometrics or device PINs). Depending on the platform and configuration, passkeys may be device-bound (stored on a single authenticator) or multi-device/synced (securely synchronized between a user's devices).

#### Hardware-backed Key Storage

For platform passkeys, the private key is generated and stored by the operating system's secure key manager. Modern platforms typically provide hardware-backed protection for these keys, such as the Trusted Platform Module (TPM) on Windows, Secure Enclave on Apple devices, or the Android Keystore/StrongBox on Android.

For device-bound passkeys, the private key is marked as non-exportable and is designed not to leave the authenticator on which it was created. For synced passkeys, copies of the private key (or equivalent secret) may be synchronized between a user's devices using platform-specific, typically end-to-end encrypted mechanisms, but are not exposed to relying parties or application code. During authentication, the platform security module signs a server challenge using this key material. This hardware-backed or otherwise strongly isolated protection of private keys is a core security property of passkeys and WebAuthn.

cheatsheets/Authentication_Cheat_Sheet.md

mackowski · 2026-03-26T10:18:22Z

@YK-03 can you respond to copilot review/suggestions?

Avoid overgeneralizing hardware-backed guarantees. Clarify that not all implementations are hardware-backed and relying parties should not assume non-exportability without attestation verification. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Improve guidance for passkey implementations in Authentication Cheat …

f2fabab

…Sheet

YK-03 requested review from jmanico, kwwall, mackowski and szh as code owners March 5, 2026 11:27

Fix markdownlint errors

4941673

mackowski previously approved these changes Mar 15, 2026

View reviewed changes

jmanico reviewed Mar 15, 2026

View reviewed changes

Add explanation of hardware-backed key storage for passkeys (TPM, Sec…

171e66f

…ure Enclave, Android Keystore)

YK-03 dismissed mackowski’s stale review via 171e66f March 16, 2026 18:24

mackowski requested a review from Copilot March 26, 2026 10:11

Copilot started reviewing on behalf of mackowski March 26, 2026 10:11 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve guidance for passkey implementations in Authentication Cheat …#2052

Improve guidance for passkey implementations in Authentication Cheat …#2052
YK-03 wants to merge 4 commits intoOWASP:masterfrom
YK-03:improve-passkey-guidance

YK-03 commented Mar 5, 2026

Uh oh!

jmanico commented Mar 6, 2026

Uh oh!

mackowski commented Mar 15, 2026

Uh oh!

jmanico left a comment •

edited

Loading

Uh oh!

YK-03 commented Mar 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Uh oh!

mackowski commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		FIDO2: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern Passkeys technology. Passkeys enable users to securely log in using local user verification (such as biometrics or device PINs), often with credential synchronization across devices.

		#### Hardware-backed Key Storage

Conversation

YK-03 commented Mar 5, 2026

You're A Rockstar

Description

AI Tool Usage Disclosure (required for all PRs)

Uh oh!

jmanico commented Mar 6, 2026

Uh oh!

mackowski commented Mar 15, 2026

Uh oh!

jmanico left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

YK-03 commented Mar 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mackowski commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jmanico left a comment •

edited

Loading