Are Passkeys SCA-Compliant?

Introduction: SCA Compliance and Passkeys

Strong Customer Authentication (SCA) is a critical requirement for enhancing the security of online banking applications. This article explains how passkeys can meet SCA requirements, providing secure and user-friendly authentication solutions. With the rise of fintech and mobile banking, understanding the role of passkeys in SCA compliance is essential for developers and product managers alike.

Read full blog post here

Current SCA Architecture in Online Banking

Online banking can be divided into traditional banks and neo-banks. Traditional banks often rely on desktop access with multiple authentication factors like PINs and SMS TANs, while neo-banks use native mobile apps with more advanced authentication methods. Despite these advancements, traditional methods still pose risks, such as phishing attacks, which underscore the need for more secure authentication methods like passkeys.

Device-Binding in Banking Apps

Banking apps have traditionally used device-binding for secure authentication. This involves generating a public/private key pair during registration, with the private key stored securely on the device. Device-binding ensures that authentication is tied to a specific device, enhancing security but complicating user experience during device changes.

Storing Private Keys Securely

To comply with SCA, private keys in banking apps must be stored in hardware security modules (HSMs), such as secure enclaves or TPMs. These modules prevent unauthorized access and ensure that keys are not included in backups, thereby reducing the risk of compromise.

Passkeys and SCA Compliance

Passkeys fulfill generic authentication requirements by providing two distinct authentication factors: possession and inherence. The private key, stored in a hardware security module, ensures possession, while biometric authentication (fingerprint or facial recognition) provides inherence. This combination meets SCA requirements for two independent authentication factors.

Possession Factor Analysis

For passkeys to be SCA-compliant, they must securely associate with the user, provide proof of possession, and ensure secure key storage. Passkeys achieve this by generating a cryptographically verifiable signature for each authentication attempt, proving possession of the private key.

Synced Passkeys: Meeting SCA Requirements

Synced passkeys, stored in cloud services like Apple's iCloud or Google's equivalent, also meet SCA requirements despite not being device-bound. These keys are encrypted and synced across devices securely, ensuring that the private key remains protected during transit and storage.

Security of Synced Passkeys

Synced passkeys rely on advanced security measures to protect against unauthorized access. For instance, Apple's iCloud Keychain uses encryption and multi-factor authentication (MFA) to secure passkeys. This ensures that even if a device is compromised, the private keys remain protected.

Recommendations for Financial Institutions

Financial institutions should consider integrating passkeys as a part of their authentication strategy. Here are some starting points:

1. Replace PINs and Passwords: Use passkeys as the first-factor authentication to eliminate phishable credentials.
2. Combine Passkeys with SMS OTPs: Enhance security and user experience by combining passkeys with SMS OTPs for device recovery.

By adopting passkeys, banks can significantly reduce the risk of cyber-attacks and improve user experience.

Conclusion

Passkeys, whether device-bound or synced, provide a robust and SCA-compliant authentication solution. Their ability to combine possession and inherence factors makes them ideal for securing online banking applications. As technology evolves, it is crucial for financial institutions to adopt passkeys to stay ahead in the ever-changing landscape of digital security.

Find out more on What SCA Requirements Mean for Passkeys.

This concise guide ensures that even those new to the concept can understand the importance and implementation of passkeys in meeting SCA compliance, providing a secure and seamless user experience.