SSH-Passkeys: Leveraging Web Authentication for Passwordless SSH

2025-07-11

AI Summary

SSH password and traditional key-based authentication are vulnerable to phishing, key reuse, credential leakage, and poor usability. To address these threats, this paper proposes the first WebAuthn-based passwordless SSH authentication scheme. We design a lightweight Pluggable Authentication Module (PAM) that deeply integrates the WebAuthn API into standard OpenSSH, enabling end-to-end phishing resistance, zero local key storage, strong user privacy guarantees, and cryptographically verifiable identity attestation. The solution is fully compatible with the existing SSH protocol and client ecosystem, requiring no additional software deployment. Experimental evaluation shows a 90% reduction in critical authentication errors and a fourfold decrease in average authentication latency. A user study confirms significant improvements in both security and usability over conventional methods. This work represents the first systematic, production-ready implementation of WebAuthn at the SSH layer, establishing a new, engineering-practical paradigm for passwordless remote authentication.

Technology Category

• Application Domains: Security
• Machine Learning: Privacy
• Natural Language Processing: Safety and Robustness

Application Category

• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Security and Privacy: Authentication, authorization, and access control
• Systems and Infrastructure for Web, Mobile and WoT: Decentralized Web and Fediverse systems

Abstract

We propose a method for using Web Authentication APIs for SSH authentication, enabling passwordless remote server login with passkeys. These are credentials that are managed throughout the key lifecycle by an authenticator on behalf of the user and offer strong security guarantees. Passwords remain the dominant mode of SSH authentication, despite their well known flaws such as phishing and reuse. SSH's custom key-based authentication protocol can alleviate these issues but remains vulnerable to key theft. Additionally, it has poor usability, with even knowledgeable users leaking key material and failing to verify fingerprints. Hence, effective key management remains a critical open area in SSH security. In contrast, WebAuthn is a modern authentication standard designed to replace passwords, managing keys on behalf of the user. As a web API, this standard cannot integrate with SSH directly. We propose a framework to integrate WebAuthn with SSH servers, by using UNIX pluggable authentication modules (PAM). Our approach is backwards-compatible, supports stock SSH servers and requires no new software client-side. It offers protection for cryptographic material at rest, resistance to key leaks, phishing protection, privacy protection and attestation capability. None of these properties are offered by passwords nor traditional SSH keys. We validate these advantages with a structured, conceptual security analysis. We develop a prototype implementation and conduct a user study to quantify the security advantages of our proposal, testing our prototype with 40 SSH users. The study confirms the security problems of SSH-keys, including 20% of the cohort leaking their private keys. Our SSH-passkeys effectively address these problems: we find a 90% reduction in critical security errors, while reducing authentication time by 4x on average.

Problem

• Replace password-based SSH authentication with WebAuthn passkeys
• Address vulnerabilities in traditional SSH key management
• Integrate WebAuthn into SSH without client-side software changes

Innovation

• Uses WebAuthn API for SSH authentication
• Integrates WebAuthn with SSH via PAM
• Reduces security errors by 90%