Vaulted Passkeys: A Device-Bound Proposal for Authenticated Credential Export and Import

• URL: http://arxiv.org/abs/2608.13806v1
• Date: Thu, 13 Aug 2026 22:32:49 GMT
• Title: Vaulted Passkeys: A Device-Bound Proposal for Authenticated Credential Export and Import
• Abstract summary: Existing guidance for device-bound credentials commonly reduces recovery risk by registering an additional authenticator before failure.<n>This paper addresses the resulting recovery gap by exporting protected credential state while the source is available and restoring it to hardware acquired later.<n>We propose Vaulted Passkeys, a device-bound architecture in which a random 256-bit Kvault protects authenticated PKV1 credential envelopes through HKDF-separated keys and four explicit AEAD profiles.
• Score: 0.6091702876917279
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Hardware authenticators deliberately resist private-key extraction, yet replacement, disaster recovery, and controlled migration create a legitimate need for portability. Existing guidance for device-bound credentials commonly reduces recovery risk by registering an additional authenticator before failure. That creates an independent credential registration and requires replacement hardware to exist in advance; it is redundancy, not a backup of the original credential. This paper addresses the resulting recovery gap by exporting protected credential state while the source is available and restoring it to hardware acquired later, without cloning a complete authenticator or exposing plaintext private keys to routine desktop software. We propose Vaulted Passkeys, a device-bound architecture in which a random 256-bit Kvault protects authenticated PKV1 credential envelopes through HKDF-separated keys and four explicit AEAD profiles. The design separates enrollment from export/import and the required vault from optional identity. We contribute a role-separated system model, wire format, threat analysis, implementation mapping, and falsifiable evaluation plan. The prototype demonstrates feasibility but is neither a formal security proof nor a proposed final standard.

Related papers

• Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure [2.124730017640531]
  Sovereign Assurance Boundary is a certificate-bound runtime admission layer for autonomous execution authority.<n>We detail the airlock-broker architecture, formalize its admission and revocation invariants, and report preliminary feasibility measurements from a Go prototype.
  arXiv  Detail & Related papers  (2026-06-10T03:49:57Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• An Analysis of Attack Vectors Against FIDO2 Authentication [45.88028371034407]
  This paper examines passkeys, also known as FIDO2, which claim to provide phishing-resistant authentication.<n>A private key is stored on a user's device, the authenticator, while the server stores the corresponding public key.<n>During authentication, the server generates a challenge that the user signs with the private key; the server then verifies the signature and establishes a session.
  arXiv  Detail & Related papers  (2026-04-22T17:52:56Z)
• PRETTINESS -- Privacy pResErving aTTrIbute maNagEment SyStem [0.42970700836450476]
  European Digital Identity (EUDI) Wallet aims to provide end users with a way to get attested credentials from issuers.<n>We propose a generic credential revocation system which relies on a single server and secure transmission channels between parties.
  arXiv  Detail & Related papers  (2026-03-24T13:59:00Z)
• ZK-ACE: Identity-Centric Zero-Knowledge Authorization for Post-Quantum Blockchain Systems [1.7429038786735553]
  ZK-ACE is an authorization layer that replaces transaction-carried signature objects with identity-bound zero-knowledge authorization statements.<n>We formalize ZK-ACE with explicit game-based security definitions for authorization soundness, replay resistance, substitution resistance, and cross-domain separation.<n>A structural, protocol-level data accounting demonstrates an order-of-magnitude reduction in consensus-visible authorization data relative to direct post-quantum signature deployment.
  arXiv  Detail & Related papers  (2026-03-09T05:21:44Z)
• VA-DAR: A PQC-Ready, Vendor-Agnostic Deterministic Artifact Resolution for Serverless, Enumeration-Resistant Wallet Recovery [1.7429038786735553]
  VA-DAR is a keyed-discovery protocol for ACE-GF-based wallets.<n>It supports cross-device recovery using only a user-provided identifier and a single recovery passphrase.
  arXiv  Detail & Related papers  (2026-03-03T07:33:10Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• Towards Credential-based Device Registration in DApps for DePINs with ZKPs [46.08150780379237]
  We propose a credential-based device registration (CDR) mechanism that verifies device credentials on the blockchain. We present a general system model, and technically evaluate CDR using zkSNARKs with Groth16 and Marlin.
  arXiv  Detail & Related papers  (2024-06-27T09:50:10Z)
• Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining [9.617679554145301]
  Current passport-based methods that obfuscate model functionality for license-to-use and ownership verifications suffer from capacity and quality constraints. We propose Steganographic Passport, which uses an invertible steganographic network to decouple license-to-use from ownership verification. An irreversible and collision-resistant hash function is used to avoid exposing the owner-side passport from the derived user-side passports.
  arXiv  Detail & Related papers  (2024-04-03T17:44:02Z)
• On Cryptographic Mechanisms for the Selective Disclosure of Verifiable Credentials [39.4080639822574]
  Verifiable credentials are a digital analogue of physical credentials. They can be presented to verifiers to reveal attributes or even predicates about the attributes included in the credential. One way to preserve privacy during presentation consists in selectively disclosing the attributes in a credential.
  arXiv  Detail & Related papers  (2024-01-16T08:22:28Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.