Leading password manager company, 1Password, solved one of the biggest roadblocks for widespread passkey adoption.
Until now, there was no way to encrypt your passkeys in the same way that you could encrypt a password. While passkeys have several security benefits over passwords, the fact that couldn’t be encrypted left a glaring hole in their ability to keep you safe.
Let’s say you use an app that protects all of your notes with end-to-end encryption,” 1Password explains in a blog post. “That means only you have the key required to decrypt and read your notes. Historically this key would be a password. It would be used to verify who you are and decrypt your data.
“That changes with the Pseudo-Random Function (PRF) extension.”
To explain in better detail, passkeys work by using a public and private key, with the private key only ever being seen by you. 1Password employs the PRF tool to create a third key that interacts with a randomly generated value from the website you’re trying to connect to (also called a salt).
By combining the “shared secret” with a “salt”, you can essentially create encryption that applies to passkeys.
Each website will always use the same shared secret and salt, though it will be unique to each user. Even if a hacker is able to figure out certain shared secret and salt combinations, there are billions of potential combinations per website.
“A deterministic output doesn’t mean it’s predictable. The salt on its own doesn’t tell an attacker anything about the shared secret. If the attacker knows both the salt and the final shared secret, they still can’t infer anything about the secret key nor any future shared secrets should the salt change,” 1Password explains.
While this doesn’t act as traditional encryption, the end result is the same. Your information becomes unreadable and hackers can’t intercept your passkeys.
You’ll have to use passkeys stored within the 1Password vault if you want to encrypt them. This feature is currently available in the 1Password for Android (8.10.38) and browser extension beta (2.26.1) betas.