When Quantum Computers Challenge Passkeys – Part 2
In the first part of this blog series, I looked at why passkeys are a useful entry point for discussing Post-Quantum Cryptography in the FIDO2 ecosystem. Passkeys make phishing-resistant, passwordless authentication visible to many users. Technically, however, they rely on a broader architecture built around FIDO2, WebAuthn, CTAP, authenticators, relying parties, and public-key infrastructure.
Some areas of this ecosystem, such as credential key pairs, appear relatively straightforward to migrate conceptually. Others are more complex. In this second part, I will focus on attestation infrastructure, secure channels, PIN protocols, migration challenges, and practical work on PQC-enabled FIDO.
Attestation infrastructure
Authenticators usually provide attestation certificates that are chained to certificates available through the FIDO Metadata Service. This allows a relying party to verify that an authenticator is genuine. Today, these certificates rely on traditional X.509 public-key infrastructure using ECC or RSA.
Migrating the attestation infrastructure to PQC is significantly more complex than migrating individual credential keys. It affects the Metadata Service, relying parties, authenticators, and the public-key infrastructure of the ecosystem.
Migrating a single key pair to PQC and issuing a corresponding certificate is technically manageable. Migrating the complete trust chain is much more difficult. This includes the full certificate chain and the signature scheme used by the Metadata Service.
There is also an interoperability challenge. At the moment, a relying party has no mechanism to negotiate the algorithms used within the trust chain. During a transition period, this makes interoperability more complex.
The size of PQC certificates can also become a practical issue. Larger certificates create additional storage and transmission overhead. This can be especially relevant for resource-constrained devices or protocols with strict message size limitations.
Secure channels and PIN protocols
Authenticators can verify users in different ways. In the case of hardware security keys without integrated input capabilities, CTAP defines a mechanism that allows the user to enter the PIN externally on the client. To transmit this verification information securely, CTAP defines so-called PIN/UV Auth Protocols.
Before sensitive commands are executed, the client and authenticator establish a shared secret through key establishment. The client can then send encrypted PIN verification data to the authenticator. For this, PIN/UV Auth Protocols require public-key-based key establishment mechanisms – and are therefore also affected by a PQC migration.
Today, the PIN/UV Auth Protocols use Elliptic Curve Diffie-Hellman (ECDH) to establish the shared secret for secure transmission of PIN-related information. A migration toward PQC would likely require replacing ECDH with post-quantum key encapsulation mechanisms such as ML-KEM.
Technically, this is possible. But it introduces larger messages and higher computational requirements. This can become relevant for resource-constrained authenticators.
The PIN/UV Auth Protocols are crypto-agile in the sense that they have a protocol identifier. This makes it comparatively easy to define additional variants with different algorithms. A PQ-ready PIN/UV Auth Protocol would only need to be supported by the authenticator and the client, which can simplify migration and provide advantages for interoperability and implementation speed.
Migration challenges across the FIDO ecosystem
The FIDO ecosystem already benefits from a comparatively high degree of cryptographic agility. COSE algorithm identifiers and extensible protocol structures are important foundations for this.
Nevertheless, a full PQC migration remains challenging because it requires coordination across many independent layers:
operating systems
browsers
authenticators
relying parties
certificate infrastructures
Metadata Service
certification programs
Fragmentation of cryptographic requirements across countries and industries adds another layer of complexity. Different regulatory requirements, algorithm preferences, and parameter sets can mean that both pure PQC mechanisms and hybrid variants need to be supported — potentially with different parameter sets.
This is why the post-quantum transition in FIDO2 will not be a single protocol update. It will be a gradual evolution across the entire ecosystem.
Practical example: PQC-enabled FIDO with the iShield Key 2 PQC
At Swissbit, we have implemented a practical demonstrator for PQC-enabled FIDO authentication with the iShield Key 2 PQC. The platform supports ML-DSA-based credentials. In addition, SimpleWebAuthn has been adapted as an example of a relying party implementation.
Because the platform supports field updates, it can be used to evaluate different aspects of PQC migration in the FIDO ecosystem. This includes new PIN/UV Auth Protocols, hybrid PQ-secure credentials, PQ-secure attestation, and migration approaches for additional authentication ecosystems such as PIV.
The demonstrator shows that replacing cryptographic algorithms in practice comes with concrete engineering challenges: larger messages, transport limitations, limited memory, performance impacts, and interoperability questions.
At the same time, it highlights an important strength of FIDO. Because of its crypto-agile architecture, FIDO is fundamentally better prepared for a PQC migration than many other security ecosystems.
PQC as an ecosystem task
Passkeys have made FIDO2 visible to many users as the foundation of phishing-resistant, passwordless authentication. At the same time, FIDO2 remains the technical standard behind this use case. Its strong reliance on classical public-key cryptography makes a long-term transition to Post-Quantum Cryptography inevitable.
Some components, especially credential key pairs, appear comparatively easy to migrate conceptually. Other areas, especially attestation PKI, trust chains, and resource-constrained transport layers, present much greater challenges.
The PQC transition in the FIDO ecosystem will therefore not be a single protocol update. It will be a gradual ecosystem-wide evolution requiring standardization, interoperability, and careful engineering trade-offs between security, performance, memory requirements, and practical implementation.
How well this transition succeeds will also determine how well passkeys can be prepared for the age of powerful quantum computers.
Johann Philipp Thiers is responsible for system security and cryptographic services of Swissbit’s Hyperstone flash controllers. For his dissertation in code-based post-quantum cryptography, he received a doctorate from Ulm University, Germany. He holds a Master of Engineering in Electrical Systems and a Bachelor in Electrical Engineering and Information Technology, both from the University of Applied Sciences HTWG Konstanz, Germany. Follow him on LikedIn.
Receive the latest news and announcements about storage and security solutions as well as current events and new products.