The "To Keep Up" Wiki

Password: alpha-numberic-special character sequence, a shared secret. Longer and more complex is better. Passkey: Uses Public Key Cryptology.

Short video, Passwords: use and risk

1. Sign up with a website, eg, buystuff.com
2. Buystuff accepts a password you create
3. You need to remember this password, using a password manager like KeePassXC or others
4. When you log in, you need to send the password to buystuff.com
5. Buystuff makes sure you entered the correct password and if so lets you in

1. Sign up with a website that supports passkeys, eg, goodstuff.com
2. You are using a password manager that supports passkeys
3. Your password manager creates a public and private key that's unique for you
4. You give the public key to goodstuff.com
5. The private key never leaves your device
6. When you want to log into goodstuff.com, the website creates a secret number and encrypts it using your public key, sends it to you
7. Only you can decrypt the message as only you have the private key
8. You decrypt the message and send back the secret number or phrase to goodstuff.com
9. The website goodstuff.com receives this, compares it to what they encrypted and sent, and if matches they know it is you, and you're logged in

Let's try a simple public/private key and we'll use addition as an operation and 3-digit numbers to make it easier for this example.

• Pick a public key: 359; private key will be 751. You'll see why shortly.
• Remember, everyone can know the public key but only you know the private key.
• Suppose message is 246
• Add public key:
  • 2+3 = 5
  • 4+5 = 9
  • 6+9 = 5 (drop the carry)
• Thus the encrypted message is 595
• You receive the message 595 and decrypt it using your private key (751), only you know this
  • 5+7 = 2 (drop the carry)
  • 9+5 = 4
  • 5+1 = 6
• and you decrypt the message and see 246.

Note this is a simple example. In real life a much larger public key and private key would be used involving large prime numbers and complex mathematics.

On smi's Muscat, log into Shopify.com using BitWarden for either shopify1 or shopify2 account and its passkey.

This from video this Bitwarden demo video, we'll use Shopify.

1. Set up environment once¹⁾
2. Go to Shopify.com
3. Create account with password. Save to Bitwarden.
4. Verify email so account is active.
5. Log into Shopify.com, use Bitwarden.
6. Manage account, Security
7. Create Passkey
8. Save it
9. Log out, log in. Select the icon where userID is entered, select Shopify.
10. You're logged in.

This is done once, when we sign up with a website.

1. Select two large prime numbers, p and q. For simplicity let's use p = 13 and q = 17.
2. Compute the modulus, n, by multiplying p and q: n = p * q = 13 * 17 = 221
3. Compute the Euler's totient function, φ(n), which is the number of positive integers less than n that are coprime to n:
   • φ(n) = (p - 1) * (q - 1) = (13 - 1) * (17 - 1) = 192
4. Choose a public exponent, e. It must be relatively prime to φ(n) or 192, meaning it has no common factors other than 1. For simplicity, let's choose e = 5.
5. Calculate the private exponent, d, such that (e * d) mod φ(n) = 1:
   • d = e^(-1) mod φ(n)
   • In this case, d = 77

Now that this is done, Alice has her Public Key (e, n) which is (5, 221) and her private key (d, n) which is (77, 221)

Here's how the website uses this passkey to authenticate us. Website wants to send a message to us, with passkey our job is to decode this and return the decrypted message to the website so the website will know we are who we claim.

Let's say the website encrypts the string “HELLO”, and will send it to us, we'll decrypt using our private key and return the string to the website.

1. Convert the message HE to numerical representation: 8 5 12 15
2. Using the public key (5, 221), the website computes
   • H = 8^5 mod 221 = 32768 mod 221 = 119
   • E = 5^5 mod 221 = 3125 mod 221 = 197
   • L = 12^5 mod 221 = 248831 mod 221 = 35
   • O = 15^5 mod 221 = 759375 mod 221 = 65
3. Website sends the encrypted message (119, 197, 35, 35, 65) to us

We receive the encrypted message (119, 197, 35, 35, 65) from the website.
we use our private key to decrypt the message using our private key (d, n) = (77, 221)
Applying modular exponentiation we get

• 119^77 mod 221 = 8 which is 8th letter or H
• 197^77 mod 221 = 5 which is 5th letter or E
• 35^77 mod 221 = 12 which is 12th letter or L
• 65^77 mod 221 = 15 which is 15th letter or O

We then send the plaintext HELLO back to the website. Since we're the only ones with the private key that can decode a message sent with our public key, the website knows it is really us.

In this example, we chose small prime numbers for simplicity, but in practice, much larger prime numbers are used to enhance security. The modulus (n) is derived from the product of these primes, and the public exponent (e) is chosen such that it is coprime to φ(n). The private exponent (d) is calculated using modular arithmetic. This ensures that only the possessor of the private key can decrypt messages encrypted with the corresponding public key.

• https://www.techtarget.com/whatis/feature/Passkey-vs-password-What-is-the-difference
• https://blog.1password.com/passkeys-vs-passwords-differences/
• https://tech.co/news/passkeys-vs-passwords