FIPS and FIDO2/Passkeys

In March 2020, I was all set to fly to South Korea to have our FIDO2 component for ASP.NET Core certified by the FIDO alliance. However, the pandemic stopped that, and we did the compliance testing remotely. At the time, we thought FIDO2 passwordless technology would signal the rapid decline of the password.

It's now 2024, and we are just starting to see this happen with the rebranding of FIDO2 to Passkeys and the FIDO alliance, heavily investing in standardizing the user experience, not just the protocol.

More and more of our Single Sign-On customers are asking us how to move to Passkeys. They see the massive benefit of

• Anti-phishing,
• Reduced login time
• Fewer help desk calls
• No more password breaches

Today, I'm proud to announce that v4.0 of our FIDO2/Passkey component uses a FIPS 140-3 certified cryptographic module. This assures our customers that their Passkey implementation can now employ US government-grade cryptography.

Why Might I Care About FIPS

Using FIPS-approved cryptography ensures high security and compliance, particularly for organizations working with the U.S. government or handling sensitive data. FIPS cryptography meets strict standards for encrypting and protecting information, which is crucial for safeguarding sensitive or classified data from unauthorized access. Many industries, such as healthcare and finance, may require FIPS compliance to meet legal or regulatory requirements, reduce security risks, and build trust by demonstrating that their data protection practices are robust and government-approved.

This feature does not change the way we encrypt or sign information, just that the implementations of the various crypto algorithms have been certified by NIST. Existing customers can turn it on without affecting existing users.

If you want to see how easy it is to use Passkeys, why not try out our test site or watch our getting started videos? It only takes a few lines of code, and your site could also benefit from Passkey technology.