PassKey - Android Authentication Protocol

📝Key Generation Concept

The device creates two distinct key pairs:

PKAHardware-backed RSA key pair (TEE)

PKBSoftware-backed RSA key pair

▶
Protocol Steps

1

User enters username

2

Server provides a nonce

3

Device creates hardware key with attestation (PKA)

4

Device creates software key (PKB)

5

PKA signs PKB + username + nonce

6

Everything is sent to the server

7

Server verifies: nonce freshness, attestation challenge, certificate chain, signature validity

8

Data stored securely in database

(Sequence diagram Page 28, Code Pages 43-47)

🔐Hybrid Encryption Strategy

Because hardware keys cannot encrypt directly, a hybrid method was created using AES and the software key.

▶
Protocol Steps

1

User enters username

2

Server provides a fresh nonce

3

Device signs nonce using SKA (hardware secret key)

4

Device generates AES-256 key

5

Device creates C1: nonce + signature encrypted with AES

6

Device creates C2: AES key encrypted with SKB

7

Server decrypts C2 → gets AES key

8

Server decrypts C1 → gets signature and nonce

9

Server verifies signature with stored PKA

10

Authentication successful

(Sequence diagram Page 29, Code Pages 47-52)

🔁Secure Device Transfer

Since hardware keys can't leave the device, we built a secure transfer protocol involving the Old Device, New Device, Server, and Database.

▶
Protocol Steps

1

Old device logs in and initiates transfer

2

Old device displays QR containing: Username, Nonce, PKB, SKB, Signature σ

3

New device scans QR code

4

New device saves SKB and generates new hardware PKA2

5

New device signs PKA2 using SKB

6

New device creates encrypted inner payload

7

Server verifies QR signature and SKB-signed payload

8

Server updates stored PKA → PKA2

9

Transfer complete - new device now authenticated

(Sequence diagram Page 30, Code Pages 52-58)

How It Works

📝Key Generation Concept

▶
Protocol Steps

🔐Hybrid Encryption Strategy

▶
Protocol Steps

🔁Secure Device Transfer

▶
Protocol Steps

Protocol Architecture

How It Works

📝Key Generation Concept

▶Protocol Steps

🔐Hybrid Encryption Strategy

▶Protocol Steps

🔁Secure Device Transfer

▶Protocol Steps

Protocol Architecture

▶
Protocol Steps

▶
Protocol Steps

▶
Protocol Steps