Passwordless authentication

Because PKI and FIDO are both based on asymmetric key cryptography—widely considered one of the most secure and reliable forms of encryption—they both offer the same level of security.

Both standards eliminate the need for passwords and provide end users with a seamless user experience. When cryptographic keys are generated and stored on separate credentials such as smart cards and security keys, both PKI and FIDO are suitable for achieving the highest official security levels:

• Authenticator Assurance Level 3 (AAL3), defined by the NIST SP 800-63 Digital Identity Guidelines
• Authentication Level of Assurance 4 (LoA4), defined in the ISO/IEC 29115 standard

Adjustment:

FIDO is an open standard that enjoys broad support from major technology manufacturers such as Microsoft, Google, Apple, and Amazon. FIDO is easy for IT teams to implement and benefits from nearly universal built-in client support. Organizations are free to choose how and where to deploy FIDO keys—be it through integrated passkeys on users' mobile devices, USB security tokens, or a built-in platform authenticator (where available). Although FIDO was originally developed for authentication on the open web and is widely adopted there, it is also available on major platforms for native app authentication.

PKI is also an open standard and has formed the backbone of network security since the late 1970s. However, its implementation requires more thorough planning and management. In return, it offers features that go beyond pure authentication and can be used for data encryption and digital signatures.

Management:

FIDO manages individual authentication key pairs for each service or user. These are protected from server leaks through the use of asymmetric cryptography. At the same time, the privacy of each identity is protected by preventing key pairs from being linked across services. However, this also means that IT teams don't have a central location to manage accounts.

PKI, on the other hand, is centrally managed and offers best-in-class solutions for control and reporting functions. IT teams can monitor the entire certificate lifecycle from issuance to revocation through a central management console.

Trust:

PKI is based on the hierarchical trust model, where trust is established through a trusted third party—a certificate authority (CA) that registers and issues digital certificates—and organizations that mediate this trust between users and systems. However, PKI certificates are system-agnostic, and multiple implementations are available to support them. User experience and functionality can vary considerably depending on the application.

In contrast, FIDO authentication is decentralized and establishes trust individually between systems and their users. FIDO keys can therefore only be used within the security domain in which they were originally registered. However, the user experience is extremely consistent due to the close collaboration between ecosystem players.

The decision between PKI and FIDO often depends on a company's specific requirements and existing infrastructure. Consider using PKI for passwordless authentication if:

• You already use PKI certificates for data encryption, digital signatures or server authentication
• You need stricter identity management protocols or want to use federation to accept identities outside your own security domain
• You need a centralized process for managing and verifying digital certificates

Consider using FIDO for passwordless authentication if:

• You want a faster implementation timeline
• You want to optimize integration with web and mobile apps
• You want to invest in a modern authentication backend that enables centralized management of FIDO keys for multiple applications

If you want to use both technologies in parallel, the SafeNet IDPrime smart card series from Thales is the perfect solution. These cards combine both PKI and FIDO on a single ID card.