I am still a little unclear on what this means. Isn’t the idea of passkeys that they’re stored on your PC’s TPM? What does Bitwarden “supporting passkeys” mean in that case? Are they not stored on the device if you use Bitwarden?
They’ll probably interface the key exchange from TPM, pulling and storing keys as needed from the TPM to applications you use BW with.
No, TPM isn’t involved here. There’s a few kinds of passkeys.
Hardware bound keys are locked up in a physical device like a TPM or a YubiKey. That physical device has its own security to unlock it- TPMs often work with fingerprints, or a YubiKey usually has a PIN (aka password).
A passkey can also be done in software, and that’s what’s happening here. BitWarden stores the encryption key within the BitWarden vault, so it can (eventually) be accessed by any device signed into your BitWarden account. Thus the same passkey works on your computer, laptop, phone, tablet, etc.
It’s worth noting that Google and Apple both do it this way- the passkey is stored in their password manager, and you use Face ID or fingerprint ID to unlock that.
THat would make sense given that you’d want to be able to use it across other logged in devices.
Appreciate the explanation.
I like to think of it this way in my little bubble. :) I have a Yubkey 5 with NFC. I use passkeylogin into Authentik so all I have to do is plug in my key, unlock it with my master password for the key and touch the disk and I’m logged into my site. If I view the contents of my key with the ykman software, then I can see that I have two logins, one for mobile and one for my site. Each has is different so it knows which one is mobile and which is desktop.
The same principle may apply with the PC’s TPM. Your credentials may apply the same way there. I’m not 100% familiar with the TPM process but think as long as it works with Fido2 , you should be fine.
You’re thinking about “device-bound passkeys”. Bitwarden and any other third-party credential manager leverages “synced passkeys” because they don’t control the hardware.
Synced passkeys are actually called out in the FIDO Alliance’s FAQs as preferred since they more closely align with the desired replacement of traditional passwords.
So it’s just one half of a key pair stored in Bitwarden, then? And you authenticate to Bitwarden as usual?
Well, it’s a full keypair being stored: Authenticators like Bitwarden need to first provide the public key to the relying party (RP) so the RP can issue the encrypted auth challenge. The challenge then is handed back to the authenticator, user verification happens, then the challenge is signed by the private key and sent back to the RP for verification to complete the auth ceremony.
