SSH-Passkeys: Leveraging Web Authentication for Passwordless SSH
Moe Kayali, Jonas Schmitt, Franziska Roesner

TL;DR
This paper introduces SSH-Passkeys, a method integrating WebAuthn with SSH to enable passwordless, secure, and user-friendly server login, addressing key management and security issues inherent in traditional SSH authentication.
Contribution
It presents a novel framework that combines WebAuthn with SSH via PAM, providing a backwards-compatible, passwordless authentication method with enhanced security and usability.
Findings
90% reduction in critical security errors
20% of users leaked private keys before
Authentication time reduced by 4x
Abstract
We propose a method for using Web Authentication APIs for SSH authentication, enabling passwordless remote server login with passkeys. These are credentials that are managed throughout the key lifecycle by an authenticator on behalf of the user and offer strong security guarantees. Passwords remain the dominant mode of SSH authentication, despite their well known flaws such as phishing and reuse. SSH's custom key-based authentication protocol can alleviate these issues but remains vulnerable to key theft. Additionally, it has poor usability, with even knowledgeable users leaking key material and failing to verify fingerprints. Hence, effective key management remains a critical open area in SSH security. In contrast, WebAuthn is a modern authentication standard designed to replace passwords, managing keys on behalf of the user. As a web API, this standard cannot integrate with SSH…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
