Crypto Authentication with Passkeys (Smart Wallets)

Introduction to Smart Wallets and Passkeys

In cryptocurrency, smart wallets integrated with passkeys offer enhanced security and user experience. This article explores various wallet types, the role of passkeys in smart wallets, and key recommendations for their implementation.

Read full blog post here

Understanding Wallet Types: Custodial vs. Non-Custodial

Custodial Wallets

Custodial wallets, managed by third-party services like Coinbase and Binance, handle private keys on behalf of users.

Advantages:

• User-Friendly: Simplifies the user experience by managing security and private keys.
• Recovery Options: Users can recover their accounts via customer support if access is lost.

Disadvantages:

• Trust Issues: Users must trust the service provider with their assets.
• Limited Control: Users do not have full control over their assets.

Non-Custodial Wallets

Non-custodial wallets give users complete control over their private keys and assets.

Advantages:

• Control: Users fully control their private keys and transactions.
• Security: Eliminates the risk of centralized hacks.

Disadvantages:

• Complexity: Requires users to manage their private keys and backups.
• No Recovery Options: Losing private keys can result in permanent loss of assets.

Smart Wallets and Passkeys: Enhancing Security and UX

Account Abstraction with ERC-4337

ERC-4337, also known as Account Abstraction, revolutionizes Ethereum by enabling smart contract-based accounts. This abstraction layer allows for enhanced functionalities like multi-signature security and social recovery options.

Integration of Passkeys

Passkeys enhance security and usability in smart wallets through:

• Client-Side Signing: Utilizing WebAuthn API to create and sign passkeys.
• Smart Contracts: Implementing contracts that verify P256 signatures, ensuring secure transaction authorization.
• Optimizing Gas Costs: Proposals like EIP-7212 aim to reduce gas costs for passkey verification.

Case Study: Coinbase Smart Wallet

Coinbase has integrated passkeys into its smart wallet infrastructure, simplifying wallet creation and enhancing security. However, there are notable security concerns:

• Device-Bound Passkeys: Passkeys on Windows 11 are not cloud-synced, risking loss of access if the device is lost or replaced.
• User Verification: The user verification is not as stringent as it should be, posing potential security risks.

Recommendations for Smart Wallet Providers

1. Enforce Cloud-Synced Passkeys: Ensure passkeys are backed up to the cloud to prevent loss of access.
2. Require User Verification: Set user verification to required for all authentication processes to enhance security.
3. Support Cross-Device Authentication: Utilize QR codes for passkey creation on mobile devices, especially for Windows 11 users.
4. Educate Users: Inform users about the importance of cloud-synced passkeys and the risks of device-bound passkeys.
5. Utilize Established Frameworks: Leverage existing frameworks and libraries to implement passkeys securely and efficiently.

Conclusion

Smart wallets with passkeys represent a significant advancement in the crypto wallet space, offering enhanced security and user experience. By following best practices and leveraging established standards like ERC-4337, smart wallet providers can create robust, user-friendly products that meet the evolving needs of the cryptocurrency community. Read the detailed blog post to learn more.