Passkeys in the post-quantum era: Why FIDO needs more than new algorithms

By Johann-Philipp Thiers, Security Specialist at Swissbit.

Passkeys have become one of the most tangible examples of passwordless authentication. They are easier for users, more resistant to phishing, and a major step away from passwords, shared secrets, and credential reuse. But behind the user-friendly experience sits a complex technical ecosystem: FIDO2, WebAuthn, CTAP, authenticators, relying parties, metadata services, and public-key infrastructure.

That is why the post-quantum discussion matters.

Post-Quantum Cryptography, or PQC, is gaining attention because today’s widely used public-key algorithms – including RSA and elliptic curve cryptography – are considered vulnerable to sufficiently powerful quantum computers. This is not an immediate statement about broken passkeys. It is a long-term security question: how can systems that depend on public-key cryptography be prepared before quantum computers become a practical threat?

For FIDO2 and passkeys, this question is especially relevant. Passkeys are built to provide phishing-resistant authentication by using asymmetric cryptography instead of passwords. During registration, an authenticator creates a credential-specific key pair. During authentication, it signs a challenge from the relying party with the private key. The credential is also bound to the relying party ID, typically the domain of the service, which is one of the reasons passkeys are so effective against phishing.

At first glance, preparing this for PQC may sound simple: replace the classical signature algorithm with a post-quantum one. For some parts of the ecosystem, especially credential key pairs, this is conceptually the easier part. Once suitable algorithm identifiers are registered, a relying party and an authenticator could agree on a post-quantum-secure alternative. The client mainly translates between CTAP and WebAuthn and does not necessarily need to implement the algorithm itself.

But in practice, PQC migration is not just an algorithm swap.

Post-quantum algorithms typically come with larger keys and signatures. That matters for hardware security keys and other resource-constrained authenticators, where memory, processing power, and transport limitations are real engineering factors. Message size limits in underlying protocols such as CTAP-HID can also become relevant. What looks straightforward in theory can become challenging once implemented in real devices and real authentication flows.

The more complex areas are even broader. Attestation, for example, relies on certificate chains that allow a relying party to verify whether an authenticator is genuine and trustworthy. Today, these trust chains are based on traditional X.509 PKI structures using ECC or RSA. Migrating a single key pair to PQC is one thing. Migrating an entire trust chain, including metadata service signatures, certificate formats, relying party support, and interoperability during a transition period, is much harder.

The same applies to secure channels and PIN protocols. In FIDO2, PIN/UV Auth Protocols help protect PIN-related verification data between client and authenticator. The currently specified PIN/UV Auth Protocols rely on public-key-based key establishment using Elliptic Curve Diffie-Hellman (ECDH). A PQC migration would likely require replacing ECDH with post-quantum key encapsulation mechanisms such as ML-KEM. Technically, this is feasible, but it again introduces larger messages and higher computational requirements.

The good news is that FIDO already has a relatively high degree of crypto-agility. Algorithm identifiers and extensible protocol structures create a foundation for migration. Compared with many other security ecosystems, FIDO is therefore in a comparatively good position. But crypto-agility does not remove the need for coordination. Operating systems, browsers, authenticators, relying parties, metadata services, certificate infrastructures, and certification programs all need to move in a compatible direction.

This is also why practical demonstrators are important. Some manufacturers and providers are already evaluating PQC-enabled FIDO scenarios by implementing support for ML-DSA-based credentials, adapting relying party implementations such as SimpleWebAuthn, and using field-updateable platforms to test future migration paths. Such demonstrators can be used to explore new PIN/UV Auth Protocols, hybrid PQ-secure credentials, PQ-secure attestation, and even related authentication ecosystems such as PIV.

Their value is not only in showing that PQC-enabled FIDO can work. Their real value is in revealing the engineering questions that standards discussions alone may not expose: larger message sizes, transport limitations, constrained memory, performance impact, and interoperability.

For passkeys, the conclusion is clear. They are one of the most promising ways to make phishing-resistant authentication mainstream. But their long-term resilience depends on the ability of the underlying FIDO2 ecosystem to evolve toward Post-Quantum Cryptography.

That evolution will not happen through one protocol update or one new algorithm. It will be a gradual ecosystem task – one that requires standardization, testing, interoperability, and careful engineering trade-offs. The sooner the industry evaluates these implications in practice, the better prepared passkeys will be for the post-quantum era.

About the author

Johann-Philipp Thiers is Security Specialist at Swissbit. He received his doctorate from Ulm University, Germany, with a dissertation in the field of code-based post-quantum cryptography. Since 2025, he has also been one of the Co-Chairs of the FIDO PQC Study Group within the FIDO Alliance.

Article Topics

digital identity  |  FIDO Alliance  |  FIDO2  |  passkeys  |  passwordless authentication  |  post-quantum cryptography  |  Swissbit