Recently, Microsoft announced that users can access their consumer accounts without providing passwords and using more secure authentication methods. Liat Ben-Zur, Corporate Vice President expressed high approval for using passwordless methods. So, what is passwordless authentication and what advantages does it provide?
What is passwordless authentication?
The combination of the username and password, as the traditional authentication method, is now more and more become the bottleneck of the user experience. For security consideration, more and more companies request the consumers to set their password complexity, mixing the uppercase and lowercase letters, numbers, symbols, etc. Though that helps against the hackers, it also confuses the consumers' brain.
To resolve that annoying scenario, passwordless authentication is proposed.
Actually, you may have used passwordless authentication before you know it. The most widely used passwordless authentication is fingerprint and facial recognition that is widely spread with the smartphones inventory growing.
Advantages of passwordless authentication
Compared with traditional authentication, passwordless authentication uses biometrics, such as fingerprint and facial recognition, or other forms of identity verification compatible with FIDO2 specifications, such as YubiKeys or Titans for identity authentication. The biometrics password brings not only the convenience but also higher security.
Passwordless authentication doesn't equal to insecurity, on the contrary, passwordless authentication is more secure. Generally, we believe that there is no same biometrics for any two human beings. The unique biometrics give the unique password during the identification. In addition, biometrics is much harder hacked than the combination of letters, numbers, and symbols. What's more, passwordless authentication is the best way to solve password fatigue, it doesn't require you to modify the password every month.
How to log in without a password?
Traditionally, when you register on a website, you are requested to fill in the password and username, which helps the server to identify yourself. Once you submit the information, you have to trust the server that it wouldn't leak your username and password to others, otherwise, your data may be lost unconsciously.
With using passwordless authentication, there is no need that you have to trust the server unconditionally.
Passwordless authentication uses the public key certification. The public key certificate uses a pair of encryption. One is the public key, and another is the private key. The public key can be accessed by anyone, and it is used to encrypt the content. The private key is accessible only to the owner, it is used for the decryption.
The public key certification includes two processes:
Both the server and the client have their own public keys and secret keys. For ease of description, these symbols will be used below.
Ac: Client public key
Bc: Client key
As: Server public key
Bs: Server key
Session key (session key) generation
The client requests to connect to the server, and the server sends As to the client.
The server generates a session ID (session-id), sets it to p, and sends it to the client.
The client generates a session key, sets it to q, and calculates r = p xor q.
The client encrypts r with As and sends the result to the server.
The server uses Bs to decrypt and obtain r.
The server performs the operation of r xor p to obtain q.
So far, both the server and the client know the session key q, and all subsequent transmissions will be encrypted by q.
Certification
The server generates a random number x, encrypts it with Ac and generates the result S(x), and sends it to the client
The client uses Bc to decrypt S(x) to get x
The client calculates the md5 value n(q+x) of q + x, where q is the session key obtained in the previous step
The server calculates the md5 value of q + x m(q+x)
The client sends n(q+x) to the server
The server compares m(q+x) and n(q+x), if the two are the same, the authentication is successful
And the whole process is drawn as below:
