パスキーについて今日時点の僕が知っていること / What I Know About Passkeys as of Today

Niigata 5分 Tech #6で話しました
https://niigata-5min-tech.connpass.com/event/312817/

1. ύεΩʔʹ͍ͭͯ ࠓ೔࣌఺ͷ๻͕஌͍ͬͯΔ͜ͱ Niigata 5෼ Tech #6 Yukiya Nakagawa a.k.a Nkzn / 2024.3.29
2. Who am I • ͳ͔͕ΘΏ͖΍ / ͳ͔͟Μʢ@Nkznʣ • גࣜձࣾϞχΫϧͰʮ͘Β͠ͱ͓ۚͷࣾձ՝୊Λղܾ͢Δʯ֤छࣄۀ ͷΠϯϋ΢ε։ൃʹՃ୲͍ͯ͠·͢ • ٕज़ॻయ։ൃνʔϜ΋΍ͬͯ·͢ • ΩϟογϡϨεܾࡁΞϓϦͱWebϑϩϯτΤϯυ
3. ύεΩʔීٴ͖ͯ͠·ͨ͠Ͷ
4. ύεΩʔ࢖ͬͯ·͔͢ʁ
5. ύεΩʔ࣮૷ͯ͠·͔͢ʁ
6. ๻͸࠷࣮ۙ૷ͯ͠·͢ • ٕज़ॻయWebͷύεΩʔϩάΠϯΛ࣮૷த • ۙʑϦϦʔε༧ఆͳͷͰָ͓͠Έʹ • ͓͔͛͞·Ͱղ૾౓͕΋Γ΋Γ্͕͖ͬͯͨ ※ UI͸มΘΔՄೳੑ͕͋Γ·͢
7. ·ͩษڧதͰ͕͢ ಄ͷதͷ੔ཧʹ͓෇͖߹͍͍ͩ͘͞
8. ύεΩʔͷ ͋Δଆ໘ᶃ • ϩάΠϯ࣌͸ެ։伴҉߸ͰຊਓੑΛ֬ ೝ͢Ε͹ɺαʔόʔ͔Βެ։伴͚ͩྲྀ ग़ͯ͠΋ා͘ͳ͍͠࠷ߴ͡ΌͶʁ • ϦΫΤετઌͷυϝΠϯͱηοτͰ ൿີ伴Λอ؅͓͚ͯ͠͹ɺِυϝΠϯ ͰϑΟογϯάαΠτΛ࡞ͬͯ΋ਅυ ϝΠϯͷൿີ伴͕࢖ΘΕΔ͜ͱ͸ͳ ͍͔Β࠷ߴ͡ΌͶʁ αʔόʔίϯϐϡʔλʔ
   IUUQTBVUIFYBNQMFDPN ΫϥΠΞϯτίϯϐϡʔλʔ *%
   OL[O!OL[OEFW ɹެ։伴 IUUQTBVUIFYBNQMFDPN
   *%
   OL[O!OL[OEFW ɹൿີ伴 ϩάΠϯϦΫΤετ ͷຊจ IDͱॺ໊σʔλΛ ຒΊࠐΉ ϩάΠϯϦΫΤετΛߦ͏ ॺ໊σʔλΛݕূ͢Δ ੒ޭͨ͠Β
   *%ͷຊਓੑ͕֬ೝͰ͖Δ ͜ͷαΠτ΁ͷϦΫΤετ͔࣌͠
   औΓग़ͤͳ͍
9. ύεΩʔͷ ͋Δଆ໘ᶄ • ൿີ伴ͷར༻ʹ͸ೝূثʹΑΔೝূ͕ ඞཁ • ࠷௿Ͱ΋ॴ༗ೝূ͕গͳ͍ૢ࡞ͰߦΘ ΕΔ • Touch ID౳Λ࢖ͬͨ৔߹͸ಉ࣌ʹੜମ ೝূ΋ߦΘΕΔ • ૢ࡞ͱͯ͠͸1ճͳͷͰ؆୯͔ͭૣ͍ ΫϥΠΞϯτίϯϐϡʔλʔ IUUQTBVUIFYBNQMFDPN
   *%
   OL[O!OL[OEFW ɹൿີ伴 ϩάΠϯϦΫΤετ ͷຊจ ೝূث ผͷεϚϗͰ QRίʔυΛಡΈऔΔ Touch ID౳ ൿີ伴ͷొ࿥ɾಡΈग़͠ʹ͸
   ೝূثʹΑΔೝূ͕ඞཁ ηΩϡϦςΟΩʔ
10. ύεΩʔͷ͋Δଆ໘ᶅ ΫϥΠΞϯτίϯϐϡʔλʔ ύεϫʔυϚωʔδϟʔ ύεΩʔ
    IUUQTBVUIFYBNQMFDPN
    *%
    OL[O!OL[OEFW ɹൿີ伴 ΫϥΠΞϯτίϯϐϡʔλʔ` ύεϫʔυϚωʔδϟʔ ύεΩʔ
    IUUQTBVUIFYBNQMFDPN
    *%
    OL[O!OL[OEFW ɹൿີ伴 ύεϫʔυϚωʔδϟʔͷ
    ಉظઌͷΫϥ΢υ Ϋϥ΢υܦ༝Ͱ
    ൿີ伴͕ಉظ͞ΕΔ σόΠεؒͰൿີ伴͕ڞ༗͞ΕΔͷͰɺॴ༗͍ͯ͠ΔଞͷσόΠεͰ΋ϩάΠϯ͕༰қ
11. ύεΩʔͷ͋Δଆ໘ᶅ • ҟͳΔύεϫʔυϚωʔδϟʔಉ࢜ͰͷύεΩʔͷڞ༗͸αϙʔτ͞Ε͍ͯͳ͍ • GoogleύεϫʔυϚωʔδϟʔ͸AndroidͱChromeͷύεΩʔ͚ͩΛڞ༗͢Δ • iCloudΩʔνΣʔϯ͸iOSܥͱmacOSͱSafariͷύεΩʔ͚ͩΛڞ༗͢Δ • Microsoft Authenticator͸WindowsͷύεΩʔ͚ͩΛڞ༗͢Δ • αʔυύʔςΟͷύεϫʔυϚωʔδϟʔ͸ϓϥοτϑΥʔϜΛލ͍Ͱڞ༗͢Δ • 1 Password͸1 PasswordΛར༻͢ΔՄೳͳݶΓͷϓϥοτϑΥʔϜ΁ύεΩʔΛ ڞ༗͢Δ
12. 伴ൃߦͱ ೝূث • FIDOΞϥΠΞϯε͔ΒೝఆΛ ड͚ͨೝূث (Authenticator) Ͱ伴Λൃߦ͢Δ • Ͳ͜ͷύεϫʔυϚωʔ δϟʔʹొ࿥͢Δ͔͸Ϣʔ βʔ͕બ΂Δ ɹΫϥΠΞϯτίϯϐϡʔλʔ ೝূث ύεΩʔ
    IUUQTBVUIFYBNQMFDPN
    *%
    OL[O!OL[OEFW ɹൿີ伴 *%
    OL[O!OL[OEFW ɹެ։伴 αʔόʔʹૹΔ navigator.credentials.create()
13. FIDO2 • ϩάΠϯϦΫΤετͷϖΠϩʔυͷϑΥʔϚοτ΍ॺ໊ํ๏ɺೝূث ͷن֨΍ϫʔΫϑϩʔͳͲ͕ϓϥοτϑΥʔϜ͝ͱʹ·ͪ·ͪͩͱࠔ ΔͷͰɺFIDOΞϥΠΞϯε͕ඪ४Խͨ͠ • ओͳ಺༁͸࣍ͷ2ͭ • W3C Web Authentication (WebAuthn) • Client-to-Authenticator Protocols (CTAP)
14. ೝূͷUIΛදࣔ͢Δํ๏ Ϙλϯ౳Ͱ࢝ΊΔ ʢmediation: “required”ʣ ϑΥʔϜͷIDཝͰ࢝ΊΔ ʢmediation: “conditional”ʣ navigator.credentials.get() Λݺͼग़͢ ʢࣄલʹ<input type=“email webauthn”>ͱ͔࢓ࠐΜͰ͓͘ʣ
15. αʔόʔαΠυͷ࿩ • αʔόʔͷ໾ׂͱͯ͠͸࣍ͷ2ͭͱͳΔ • navigator.credentials.get() ʹ౉͢ύϥϝʔλͷൃߦ • navigator.credentials.get() Ͱॺ໊͞Εͨ݁ՌΛड͚औͬͯݕূ͢Δ • 1ճͷϩάΠϯͰ navigator.credentials.get() ͷલޙʹ1ճͣͭαʔόʔʹϦΫΤετ͢Δ͜ͱʹͳΔ • ύεϫʔυΛ֬ೝ͢Δͷͱൺ΂Ε͹͸Δ͔ʹ೉͍͠ͷͰɺࣗલͰ͸࣮૷Ͱ͖ͳ͍ਓ΋ଟͦ͏ • IDaaSͷରԠ͕ਐΉͱύεΩʔ͕ීٴ͍͖ͯͦ͠͏ • Auth0, Okta, GMOτϥετϩάΠϯ, StartInͳͲɺύεΩʔରԠΛՎ͏IDaaS͸૿͖͍͑ͯͯΔ • Firebase Authentication͸H1 2024ʹϓϨϏϡʔ൛͕ग़Δ͔΋
16. WebAuthn • σϞαΠτ: https://webauthn.io/
17. ࢀߟจݙ • https://goo.gle/passkeys • https:// fi doalliance.org/speci fi cations/ • https:// fi doalliance.org/ fi do2-2/ fi do2-web-authentication-webauthn/ • https://webauthn.io/ • https://blog.agektmr.com/2019/03/ fi do-webauthn • https://blog.agektmr.com/2022/12/passkey • https://blog.agektmr.com/2023/12/passkey-mythbusting • https:// fi rebase.uservoice.com/forums/948424-general/suggestions/46647016-support-authentication- with-passkeys • https://moneyforward-dev.jp/entry/2023/04/05/134721