Passkey industry group releases draft standard for import and export
The FIDO Alliance, which oversees the specifications for passkeys, has released a draft standard for the import and export of those cryptographic keys:
FIDO Alliance’s draft specifications – Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) – define a standard format for transferring credentials in a credential manager including passwords, passkeys and more to another provide in a manner that ensures transfer are not made in the clear and are secure by default.
Once standardized, these specifications will be open and available for credential providers to implement so their users can have a secure and easy experience when and if they choose to change providers.
Currently, there’s no easy way to move your passkeys from one password manager to another. So if you generate a passkey in Apple’s Passwords app, for example, it can’t easily be moved to 1Password—or vice versa. In fact, the only way to currently share a passkey at all from Apple’s Passwords app (aside from via a Shared Password group) is via AirDrop. And because these are large cryptographic keys, it’s not as if you can simply memorize them and enter them somewhere else.
Passwords, by comparison, are easily shareable, but that same ability makes them easier to compromise, because they’re generally just exported as plaintext. The standards proposed for passkeys, by comparison, would allow for secure exchange between applications.
These standards are in draft format, meaning it will be some time before they are approved and then eventually implemented in various programs. Apple has not specifically commented on whether it will adopt the standards for its own app—notably, the contributors to the standard includes reps from 1Password, Dashlane, Bitwarden, NordPass, and Google—but the company is a member of the FIDO Alliance.
[via 9to5Mac]