[FEATURE] Passkeys/FIDO2 support

[pando85]

Is your feature request related to a problem? Please describe.

Hello. First of all, thank you for taking the lead in this app maintenance and for the improvements you made.

I recently wrote a FIDO2/passkeys Linux app backed by pass called passless and now that I have my Passkeys in my pass repository, I was thinking if I could remove my Passkey dependency with Android.

I don't have much Android development experience, but I would like to get the feature done so I could contribute to it. I opened the issue to ask if you will be interested in this kind of feature and check if it makes sense to integrate it here.

Describe the solution you'd like

FIDO2/Passkeys Android integration for being able to use my passkeys backed by pass in my Android devices.

Describe alternatives you've considered

A separate application that would manage it, but it will require rewriting all the logic in this repository because I will need to sync passkeys and decrypt them as we are currently doing here.

Additional context

No response

[agrahn]

Thank you for suggesting this feature which is definitely worth being looked at. I have no experience with passkeys so far, and it is not yet clear to me, how the web-page that I want to login to and the app would communicate. I guess, the page sends a challenge and the app would need to generate a response using the stored private key and send it back to the page? I tried to build your passless application on my Linux box in order to experiment with it a bit. However I get a build error (I have rust-1.91.0):

$ make build
cargo build --release
   Compiling tss-esapi-sys v0.5.0
   Compiling serde_spanned v0.6.9
   Compiling cbor4ii v1.2.0
   Compiling toml_datetime v0.6.11
   Compiling tracing-attributes v0.1.30
   Compiling static_assertions v1.1.0
   Compiling opaque-debug v0.3.1
   Compiling itoa v1.0.15
   Compiling powerfmt v0.2.0
   Compiling cfg-if v0.1.10
error: failed to run custom build command for `tss-esapi-sys v0.5.0`

Caused by:
  process didn't exit successfully: `/home/grahn/c/passless/target/release/build/tss-esapi-sys-53e207d63ab527c9/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=TSS2_SYS_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=TSS2_SYS_STATIC
  cargo:rerun-if-env-changed=TSS2_SYS_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR

  --- stderr

  thread 'main' (21244) panicked at /home/grahn/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tss-esapi-sys-0.5.0/build.rs:42:14:
  Failed to find tss2-sys library.: 
  pkg-config exited with status code 1
  > PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags tss2-sys 'tss2-sys >= 2.4.6'

  The system library `tss2-sys` required by crate `tss-esapi-sys` was not found.
  The file `tss2-sys.pc` needs to be installed and the PKG_CONFIG_PATH environment variable must contain its parent directory.
  The PKG_CONFIG_PATH environment variable is not set.

  HINT: if you have installed the library, try setting PKG_CONFIG_PATH to the directory containing `tss2-sys.pc`.

  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...

[pando85]

I used ChatGPT to explain a summary of the key points here:

When a website requests authentication, the browser invokes the Web Authentication API (WebAuthn). The browser delegates cryptographic operations to an authenticator (platform authenticator like Touch ID/Windows Hello, or a roaming key). During registration, a unique public/private key pair is generated per site; the public key is sent to the server, and the private key never leaves the authenticator. During login, the server sends a challenge, which the authenticator signs after user presence/verification, and the browser returns the assertion to the server.

Key differences:

• FIDO2: The overall standard from the FIDO Alliance. It combines WebAuthn (browser ↔ server API) and CTAP (browser ↔ authenticator protocol).
• WebAuthn: The W3C web standard implemented by browsers. It defines how websites register and authenticate users using public-key credentials.
• Passkeys: A UX and credential model built on top of FIDO2/WebAuthn. Passkeys are discoverable, user-friendly credentials that can sync across devices and replace passwords entirely, while still using the same underlying cryptography.

In short: WebAuthn is the browser API, FIDO2 is the full standards stack, and passkeys are a modern, passwordless user experience built on top of both.

It seems that your build is failing because you are missing TPM related dependencies. I added some docs to help with that here.

There are many places to test WebAuthn, such as https://webauthn.io/ or https://webauthn.firstyear.id.au/. Many services support it as well, including GitHub; you can also check this list: https://passkeyindex.io/.