パスキーについて今日時点の僕が知っていること / What I Know About Passkeys as of Today

by Yukiya Nakagawa

Slide 1

Slide 1 text

ύεΩʔʹ͍ͭͯ ࠓ೔࣌఺ͷ๻͕஌͍ͬͯΔ͜ͱ Niigata 5෼ Tech #6 Yukiya Nakagawa a.k.a Nkzn / 2024.3.29

Slide 2

Slide 2 text

Who am I • ͳ͔͕ΘΏ͖΍ / ͳ͔͟Μʢ@Nkznʣ • גࣜձࣾϞχΫϧͰʮ͘Β͠ͱ͓ۚͷࣾձ՝୊Λղܾ͢Δʯ֤छࣄۀ ͷΠϯϋ΢ε։ൃʹՃ୲͍ͯ͠·͢ • ٕज़ॻయ։ൃνʔϜ΋΍ͬͯ·͢ • ΩϟογϡϨεܾࡁΞϓϦͱWebϑϩϯτΤϯυ

Slide 3

Slide 3 text

ύεΩʔීٴ͖ͯ͠·ͨ͠Ͷ

Slide 4

Slide 4 text

ύεΩʔ࢖ͬͯ·͔͢ʁ

Slide 5

Slide 5 text

ύεΩʔ࣮૷ͯ͠·͔͢ʁ

Slide 6

Slide 6 text

๻͸࠷࣮ۙ૷ͯ͠·͢ • ٕज़ॻయWebͷύεΩʔϩάΠϯΛ࣮૷த • ۙʑϦϦʔε༧ఆͳͷͰָ͓͠Έʹ • ͓͔͛͞·Ͱղ૾౓͕΋Γ΋Γ্͕͖ͬͯͨ ※ UI͸มΘΔՄೳੑ͕͋Γ·͢

Slide 7

Slide 7 text

·ͩษڧதͰ͕͢ ಄ͷதͷ੔ཧʹ͓෇͖߹͍͍ͩ͘͞

Slide 8

Slide 8 text

ύεΩʔͷ ͋Δଆ໘ᶃ • ϩάΠϯ࣌͸ެ։伴҉߸ͰຊਓੑΛ֬ ೝ͢Ε͹ɺαʔόʔ͔Βެ։伴͚ͩྲྀ ग़ͯ͠΋ා͘ͳ͍͠࠷ߴ͡ΌͶʁ • ϦΫΤετઌͷυϝΠϯͱηοτͰ ൿີ伴Λอ؅͓͚ͯ͠͹ɺِυϝΠϯ ͰϑΟογϯάαΠτΛ࡞ͬͯ΋ਅυ ϝΠϯͷൿີ伴͕࢖ΘΕΔ͜ͱ͸ͳ ͍͔Β࠷ߴ͡ΌͶʁ αʔόʔίϯϐϡʔλʔ IUUQTBVUIFYBNQMFDPN ΫϥΠΞϯτίϯϐϡʔλʔ *%OL[O!OL[OEFW ɹެ։伴 IUUQTBVUIFYBNQMFDPN *%OL[O!OL[OEFW ɹൿີ伴 ϩάΠϯϦΫΤετ ͷຊจ IDͱॺ໊σʔλΛ ຒΊࠐΉ ϩάΠϯϦΫΤετΛߦ͏ ॺ໊σʔλΛݕূ͢Δ ੒ޭͨ͠Β *%ͷຊਓੑ͕֬ೝͰ͖Δ ͜ͷαΠτ΁ͷϦΫΤετ͔࣌͠ औΓग़ͤͳ͍

Slide 9

Slide 9 text

ύεΩʔͷ ͋Δଆ໘ᶄ • ൿີ伴ͷར༻ʹ͸ೝূثʹΑΔೝূ͕ ඞཁ • ࠷௿Ͱ΋ॴ༗ೝূ͕গͳ͍ૢ࡞ͰߦΘ ΕΔ • Touch ID౳Λ࢖ͬͨ৔߹͸ಉ࣌ʹੜମ ೝূ΋ߦΘΕΔ • ૢ࡞ͱͯ͠͸1ճͳͷͰ؆୯͔ͭૣ͍ ΫϥΠΞϯτίϯϐϡʔλʔ IUUQTBVUIFYBNQMFDPN *%OL[O!OL[OEFW ɹൿີ伴 ϩάΠϯϦΫΤετ ͷຊจ ೝূث ผͷεϚϗͰ QRίʔυΛಡΈऔΔ Touch ID౳ ൿີ伴ͷొ࿥ɾಡΈग़͠ʹ͸ ೝূثʹΑΔೝূ͕ඞཁ ηΩϡϦςΟΩʔ

Slide 10

Slide 10 text

ύεΩʔͷ͋Δଆ໘ᶅ ΫϥΠΞϯτίϯϐϡʔλʔ ύεϫʔυϚωʔδϟʔ ύεΩʔ IUUQTBVUIFYBNQMFDPN *%OL[O!OL[OEFW ɹൿີ伴 ΫϥΠΞϯτίϯϐϡʔλʔ` ύεϫʔυϚωʔδϟʔ ύεΩʔ IUUQTBVUIFYBNQMFDPN *%OL[O!OL[OEFW ɹൿີ伴 ύεϫʔυϚωʔδϟʔͷ ಉظઌͷΫϥ΢υ Ϋϥ΢υܦ༝Ͱ ൿີ伴͕ಉظ͞ΕΔ σόΠεؒͰൿີ伴͕ڞ༗͞ΕΔͷͰɺॴ༗͍ͯ͠ΔଞͷσόΠεͰ΋ϩάΠϯ͕༰қ

Slide 11

Slide 11 text

ύεΩʔͷ͋Δଆ໘ᶅ • ҟͳΔύεϫʔυϚωʔδϟʔಉ࢜ͰͷύεΩʔͷڞ༗͸αϙʔτ͞Ε͍ͯͳ͍ • GoogleύεϫʔυϚωʔδϟʔ͸AndroidͱChromeͷύεΩʔ͚ͩΛڞ༗͢Δ • iCloudΩʔνΣʔϯ͸iOSܥͱmacOSͱSafariͷύεΩʔ͚ͩΛڞ༗͢Δ • Microsoft Authenticator͸WindowsͷύεΩʔ͚ͩΛڞ༗͢Δ • αʔυύʔςΟͷύεϫʔυϚωʔδϟʔ͸ϓϥοτϑΥʔϜΛލ͍Ͱڞ༗͢Δ • 1 Password͸1 PasswordΛར༻͢ΔՄೳͳݶΓͷϓϥοτϑΥʔϜ΁ύεΩʔΛ ڞ༗͢Δ

Slide 12

Slide 12 text

伴ൃߦͱ ೝূث • FIDOΞϥΠΞϯε͔ΒೝఆΛ ड͚ͨೝূث (Authenticator) Ͱ伴Λൃߦ͢Δ • Ͳ͜ͷύεϫʔυϚωʔ δϟʔʹొ࿥͢Δ͔͸Ϣʔ βʔ͕બ΂Δ ɹΫϥΠΞϯτίϯϐϡʔλʔ ೝূث ύεΩʔ IUUQTBVUIFYBNQMFDPN *%OL[O!OL[OEFW ɹൿີ伴 *%OL[O!OL[OEFW ɹެ։伴 αʔόʔʹૹΔ navigator.credentials.create()

Slide 13

Slide 13 text

FIDO2 • ϩάΠϯϦΫΤετͷϖΠϩʔυͷϑΥʔϚοτ΍ॺ໊ํ๏ɺೝূث ͷن֨΍ϫʔΫϑϩʔͳͲ͕ϓϥοτϑΥʔϜ͝ͱʹ·ͪ·ͪͩͱࠔ ΔͷͰɺFIDOΞϥΠΞϯε͕ඪ४Խͨ͠ • ओͳ಺༁͸࣍ͷ2ͭ • W3C Web Authentication (WebAuthn) • Client-to-Authenticator Protocols (CTAP)

Slide 14

Slide 14 text

ೝূͷUIΛදࣔ͢Δํ๏ Ϙλϯ౳Ͱ࢝ΊΔ ʢmediation: “required”ʣ ϑΥʔϜͷIDཝͰ࢝ΊΔ ʢmediation: “conditional”ʣ navigator.credentials.get() Λݺͼग़͢ ʢࣄલʹͱ͔࢓ࠐΜͰ͓͘ʣ

Slide 15

Slide 15 text

αʔόʔαΠυͷ࿩ • αʔόʔͷ໾ׂͱͯ͠͸࣍ͷ2ͭͱͳΔ • navigator.credentials.get() ʹ౉͢ύϥϝʔλͷൃߦ • navigator.credentials.get() Ͱॺ໊͞Εͨ݁ՌΛड͚औͬͯݕূ͢Δ • 1ճͷϩάΠϯͰ navigator.credentials.get() ͷલޙʹ1ճͣͭαʔόʔʹϦΫΤετ͢Δ͜ͱʹͳΔ • ύεϫʔυΛ֬ೝ͢Δͷͱൺ΂Ε͹͸Δ͔ʹ೉͍͠ͷͰɺࣗલͰ͸࣮૷Ͱ͖ͳ͍ਓ΋ଟͦ͏ • IDaaSͷରԠ͕ਐΉͱύεΩʔ͕ීٴ͍͖ͯͦ͠͏ • Auth0, Okta, GMOτϥετϩάΠϯ, StartInͳͲɺύεΩʔରԠΛՎ͏IDaaS͸૿͖͍͑ͯͯΔ • Firebase Authentication͸H1 2024ʹϓϨϏϡʔ൛͕ग़Δ͔΋

Slide 16

Slide 16 text

WebAuthn • σϞαΠτ: https://webauthn.io/

Slide 17

Slide 17 text

ࢀߟจݙ • https://goo.gle/passkeys • https:// fi doalliance.org/speci fi cations/ • https:// fi doalliance.org/ fi do2-2/ fi do2-web-authentication-webauthn/ • https://webauthn.io/ • https://blog.agektmr.com/2019/03/ fi do-webauthn • https://blog.agektmr.com/2022/12/passkey • https://blog.agektmr.com/2023/12/passkey-mythbusting • https:// fi rebase.uservoice.com/forums/948424-general/suggestions/46647016-support-authentication- with-passkeys • https://moneyforward-dev.jp/entry/2023/04/05/134721