TUSH-Key: Transferable User Secrets on Hardware Key
Aditya Mitra, Anisha Ghosh, Sibi Chakkaravarthy Sethuraman

TL;DR
This paper introduces TUSH-Key, a novel hardware-based system enabling secure, seamless, cross-platform passwordless authentication by managing transferable user secrets, addressing limitations of existing FIDO passkeys.
Contribution
The paper presents TUSH-Key, a new private key management system that allows device transferability and synchronization for passwordless authentication, overcoming proprietary and cross-platform issues.
Findings
Enables cross-platform device synchronization for passwordless login.
Addresses security and privacy concerns of proprietary cloud-based passkeys.
Demonstrates seamless user experience across multiple devices.
Abstract
Passwordless authentication was first tested for seamless and secure merchant payments without the use of passwords or pins. It opened a whole new world of authentications giving up the former reliance on traditional passwords. It relied on the W3C Web Authentication (WebAuthn) and Client to Authenticator Protocol (CTAP) standards to use the public key cryptosystem to uniquely attest a user's device and then their identity. These standards comprise of the FIDO authentication standard. As the popularity of passwordless is increasing, more and more users and service providers are adopting to it. However, the concept of device attestation makes it device-specific for a user. It makes it difficult for a user to switch devices. FIDO Passkeys were aimed at solving the same, synchronizing the private cryptographic keys across multiple devices so that the user can perform passwordless…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsUser Authentication and Security Systems · Advanced Authentication Protocols Security · Privacy, Security, and Data Protection
