Det var intressant att Apple-representanten sade det. Det går ju rakt emot det som Apple själva skriver i sin utvecklardokumentation:

“There are two forms of public-private key authentication: passkeys and security keys. With passkeys, the device stores its public-private key pair in the user’s iCloud Keychain and syncs the keys across the user’s devices.”
https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication

Ifall inte de privata nycklarna synkroniseras (end-to-end-krypterat) till Icloud Keychain vore det inte heller möjligt för en användare att återfå åtkomsten till sina konton ifall användaren förlorat alla sina Apple-enheter. Detta sade Apple att var möjligt på WWDC 2021.

“Passkeys are WebAuthn credentials with the amazing security that the standard provides combined with the usability of being backed up, synced, and working on all of your devices. We’re storing them in iCloud Keychain. Just like everything else in your iCloud Keychain, they’re end-to-end encrypted, so not even Apple can read them. /…/ And since it’s backed by iCloud Keychain, you can still get your credentials back, even if you lose all of your Apple devices.”
https://developer.apple.com/videos/play/wwdc2021/10106/

Google skriver samma sak.

“What happens if a user loses their device? Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. That means a users’ passkeys go with them when they replace their devices. To sign into apps on a new phone, all users need to do is unlock their phone.”
https://developers.google.com/identity/fido

Som Apple lyfte upp på årets WWDC går det också att dela passkeys med andra användare via Airdrop.

“I can tap on our shared account to pull up more details. Here, I can get some information about my saved passkey or add a note to this account. I can also share my passkey. There’s my partner’s phone. I’ll go ahead and select that. Now my partner has the passkey too. And that’s how easy it is to use passkeys everywhere.”
https://developer.apple.com/videos/play/wwdc2022/10092/

Jag söker gärna med Apple-ingenjören som du talade med på WWDC. Det vore mycket intressant. Ifall du har möjlighet att delge mig vem det var du talade med så får du gärna göra det. Du når mig på ke.nikka@nikkasystems.com (PGP via WKD) eller 0735181000 (Signal).

Hej Theo. Nej, de privata nycklarna stannar inte i T2-enklaven. De synkroniseras mellan enheter via Icloud Keychain. Jag lägger med länkarna till Apples och Googles utvecklardokumentation ifall du eller andra förbipasserande läsare vill veta mer.

Apple: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication
”With passkeys, the device stores its public-private key pair in the user’s iCloud Keychain and syncs the keys across the user’s devices.”

Google: https://developers.google.com/identity/fido

Apple: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication
”With passkeys, the device stores its public-private key pair in the user’s iCloud Keychain and syncs the keys across the user’s devices.”

Google: https://developers.google.com/identity/fido

Hej

Tackar för kommentaren, jag ska skicka detta vidare till Karl-Emil, så får han svarar.

Mvh
Erik Zalitis