# public key Published articles for public key. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Why stateless JWT logout is not immediate and how to revoke access DevFeed: [Why stateless JWT logout is not immediate and how to revoke access]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T01:36:54Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [JSON Web Tokens](), [Security](), [Architecture & Design]() Tags: [jwt](), [public-key](), [rotation](), [security](), [stateless](), [token](), [verification]() ### AI overview The article explains that signed stateless JWTs remain valid until expiration, so logging out or deactivating a user cannot revoke an already-issued token immediately. It compares short-lived access tokens with refresh-token rotation against a server-side denylist as approaches to revocation. ### Source excerpt Stateless JWTs stay valid until they expire, so logout isn't instant. Here's why enterprise SCIM makes that a compliance problem -- and how to really fix it. ## Linux ssh-keygen: Set Up SSH Key Authentication the Right Way DevFeed: [Linux ssh-keygen: Set Up SSH Key Authentication the Right Way]() Original publisher: [Read original article]() Author: Hayden James Published: 2026-08-03T10:53:19Z Content type: tutorial Language: en Sources: [Hayden James]() Topics: [OpenSSH](), [ssh](), [Linux](), [Authentication](), [Security](), [passwords]() Tags: [authentication](), [blog](), [guide](), [linux](), [openssh](), [password](), [private-key](), [public-key](), [security](), [server](), [ssh](), [sysadmins]() ### AI overview A practical guide to setting up SSH key authentication on Linux with ssh-keygen. It covers generating key pairs, copying public keys to servers, disabling password login safely, configuring multiple identities, and using passphrases or FIDO2 security keys. ### Source excerpt Password-based SSH login is a liability. This guide walks through generating SSH key pairs with ssh-keygen, deploying public keys, disabling password authentication, and managing multiple keys cleanly with ~/.ssh/config. Continue reading... ## Developer and security research roundup: DNS resilience, RIPE NCC token exposure, IPv6 measurement, and quantum cryptography DevFeed: [Developer and security research roundup: DNS resilience, RIPE NCC token exposure, IPv6 measurement, and quantum cryptography]() Original publisher: [Read original article]() Author: Russ Published: 2026-06-19T12:04:04Z Content type: article Language: en Sources: [rule 11 reader]() Topics: [Amazon Route 53](), [Resilience](), [Network](), [Security, Privacy and Abuse Prevention](), [Quantum Computing](), [Cryptography](), [Internet]() Tags: [cryptography](), [dns](), [ipv6](), [network](), [public-key](), [quantum](), [resilience](), [rsa](), [worth-reading]() ### AI overview A roundup of developer and security research covering authoritative DNS resilience, exposed RIPE NCC single sign-on session tokens, IPv6 address measurement, asset speculation, and progress toward quantum computers breaking RSA-based public-key cryptography. ### Source excerpt In this post, I discuss our recent work that models and analyses the resilience of authoritative DNS infrastructure that supports individual domain names on the Internet. The RIPE NCC made its all-powerful single sign-on tokens available to over 1000 third parties. From a single link click, any logged-in RIPE NCC user would leak their session token. Identifying active IPv6 addresses is a challenging task, but it's also an important one. As researchers and network operators, it helps us understand the current deployment, identify weak spots that need strengthening, and detect vulnerable devices for disclosure. The fundamental bubble barometer is that speculators buy an asset because they expect the price to keep rising, not because they want the income generated by the asset. Indeed, most speculators don't plan on holding the asset long enough receive any income. Recently, there has been a surge in progress in quantum computing that has shortened the hypothetical timeline on which quantum computers can 'break' traditional public-key cryptography that uses the RSA scheme. ## Introducing JWT Signing Keys DevFeed: [Introducing JWT Signing Keys]() Original publisher: [Read original article]() Author: Stojan Dimitrovski Published: 2025-07-14T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [JSON Web Tokens](), [Security](), [Cryptography](), [Supabase](), [API keys]() Tags: [api-keys](), [compliance](), [cryptography](), [jwt](), [latency](), [public-key](), [rotation](), [rsa](), [security](), [soc2]() ### AI overview Supabase introduces asymmetric JWT signing keys for Supabase Auth, along with new API keys to support migration and improve application security. The system uses a private key for signing and a public key for local token verification, reducing dependence on the Auth server, network latency, and shared-secret management. It supports RSA and elliptic-curve signing algorithms and safer key rotation. ### Source excerpt A new JWT signing keys system based on public key cryptography to improve your project's security and performance. ## New Maven Central signing key and snapshot location DevFeed: [New Maven Central signing key and snapshot location]() Original publisher: [Read original article]() Author: Jake Wharton Published: 2025-06-13T00:00:00Z Content type: release Language: en Sources: [Cash App Code Blog]() Topics: [Maven Central](), [Maven](), [Publishing](), [Open Source]() Tags: [end-of-life](), [maven-central](), [open-source-artifacts](), [public-key](), [release](), [server-android](), [signing](), [snapshot](), [snapshots](), [verification]() ### AI overview Cash App migrated its open source artifact publishing to Sonatype's new platform after OSSRH reached end of life. The change introduces a company-wide GPG signing key and moves snapshot builds to the Central Portal Snapshot repository. ### Source excerpt In response to Sonatype announcing the end-of-life for OSSRH, we have migrated to their new publishing platform for our open source artifacts. This is otherwise a transparent change for those who consume these artifacts from Maven Central, but there are two related changes which might affect your builds. ## A bit more on Twitter/X's new encrypted messaging DevFeed: [A bit more on Twitter/X's new encrypted messaging]() Original publisher: [Read original article]() Author: Matthew Green Published: 2025-06-09T18:22:31Z Content type: article Language: en Sources: [Matthew Green]() Topics: [End-to-End Encryption](), [X (Twitter)](), [Encryption](), [Security](), [vulnerability](), [public key](), [Ratchet](), [Server](), [passwords](), [Meta]() Tags: [e2e](), [encryption](), [instagram](), [messaging](), [messenger](), [protocol](), [protocols](), [public-key](), [secret-storage](), [security](), [signal](), [technology](), [vulnerability]() ### AI overview This article examines XChat, X's end-to-end encrypted messaging protocol, focusing on its lack of forward secrecy and its server-side storage of user private keys. It explains the Juicebox key-storage design and argues that the security of the system depends heavily on its deployment and server protections. ### Source excerpt Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about Twitter (uh, X)'s new end-to-end encryption messaging protocol, which is now called XChat. The TL;DR of Matthew's post ... Continue reading A bit more on Twitter/X's new encrypted messaging -> ## Real World Crypto 2024 DevFeed: [Real World Crypto 2024]() Original publisher: [Read original article]() Published: 2024-05-07T11:00:17Z Content type: article Language: en Sources: [Latacora]() Topics: [Cryptography](), [Certificate Transparency](), [Security, Privacy and Abuse Prevention](), [Post-Quantum]() Tags: [browsers](), [certificate-transparency](), [cryptography](), [internet](), [post-quantum](), [privacy](), [public-key](), [security]() ### AI overview A blog post records notes from Real World Crypto 2024 in Toronto, discussing applied cryptography trends including post-quantum messaging, key transparency, and privacy-enhancing technologies. It also describes Certificate Transparency's Levchin Prize recognition and its role in improving accountability for the Web Public Key Infrastructure. ### Source excerpt We traveled to Toronto this year to attend RWC 2024. The conference was held in TIFF Lightbox located in the city's downtown; the venue is the headquarters for the Toronto Film Festival and contains five cinema rooms. RWC is a single-tracked conference and there's no hard requirement that talks are backed by papers. Each RWC includes the Levchin prize ceremony for major achievements in applied cryptography, several invited talks and the lightning talks session. ## A symmetric-key approach to post-quantum Web PKI DevFeed: [A symmetric-key approach to post-quantum Web PKI]() Original publisher: [Read original article]() Author: Adam Langley Published: 2024-04-07T00:00:00Z Content type: opinion Language: en Sources: [ImperialViolet]() Topics: [Cryptography](), [Post-Quantum](), [Encryption](), [TLS (Transport Layer Security)](), [public key](), [Security, Privacy and Abuse Prevention](), [kerberos]() Tags: [cryptography](), [dns](), [don-t](), [kerberos](), [post-quantum](), [public](), [public-key](), [tls]() ### AI overview The article proposes using DNS records and shared symmetric keys with multiple certificate authorities to help authenticate a Kyber key agreement between a client and server. It notes that initial public-key connections to the authorities would still require large post-quantum signatures and raises privacy and policy concerns because authorities could observe which servers clients contact. ### Source excerpt (I think this is worth pondering, but I don't mean it too seriously--don't panic.) Are the sizes of post-quantum signatures getting you down? Are you despairing of deploying a post-quantum Web PKI? Don't fret! Symmetric cryptography is post-quantum too! When you connect to a site, also fetch a record from DNS that contains a handful of "CA" records. Each contains: a UUID that identifies a CA ECA-key(server-CA-key, AAD=server-hostname) A key ID so that the CA can find "CA-key" from the previous field. "CA-key" is a symmetric key known only to the CA, and "server-CA-key" is a symmetric key known to the server and the CA. The client finds three of these CA records where the UUID matches a CA that the client trusts. It then sends a message to each CA containing: ECA-key'(client-CA-key) -- i.e. a key that the client and CA share, encrypted to a key that only the CA knows. We'll get to how the client has such a value later. A key ID for CA-key'. Eclient-CA-key(client-server-key) -- the client randomly generates a client-server key for each CA. The CA record from the server's DNS. The hostname that the client is connecting to. The CA can decrypt "client-CA-key" and then it can decrypt "server-CA-key" (from the DNS information that the client sent) using an AAD that's either the client's specified hostname, or else that hostname with the first label replaced with *, for wildcard records. The CA replies with Eserver-CA-key(client-server-key), i.e. the client's chosen key, encrypted to the server. The client can then start a TLS connection with the server, send it the three encrypted client-server keys, and the client and server can authenticate a Kyber key-agreement using the three shared keys concatenated. Both the client and server need symmetric keys established with each CA for this to work. To do this, they'll need to establish a public-key authenticated connection to the CA. So these connections will need large post-quantum signatures, but that cost can be amortised over ## Connect Using EC2 Instance Connect via Teleport DevFeed: [Connect Using EC2 Instance Connect via Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Marco Dinis) Published: 2023-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EC2](), [ssh](), [AWS IAM](), [WebSocket]() Tags: [amazon-ec2](), [aws](), [aws-iam](), [public-key](), [ssh](), [tcp](), [websocket]() ### AI overview This post explains how Teleport integrates with Amazon EC2 Instance Connect Endpoint to provide agentless SSH access to public or private Linux EC2 instances, including instances without public IP addresses. It describes IAM-controlled access, temporary SSH public keys, WebSocket tunneling, and SSH authentication. ### Source excerpt This post describes a new Teleport feature that enables SSH access using the EC2 Instance Connect Endpoint. ## Keycloak 23.0.1 released DevFeed: [Keycloak 23.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-11-29T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [OpenID connect (OIDC)](), [saml](), [certificates](), [public key]() Tags: [bugs](), [http](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [oidc](), [openid-connect](), [public-key](), [release](), [saml](), [sso](), [update](), [x509]() ### AI overview Keycloak 23.0.1 was released on November 29, 2023. The release notes provide download and upgrade guidance and list resolved issues involving LDAP user storage, Firefox storage access, the admin console, X509 certificate validation, SAML, the Operator, group search, and token refresh. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #23841 Users page with LDAP User Storage Provider Cannot read properties of undefined admin/ui #23872 Attempt to request storage access in Firefox oidc #24261 "Unlink users"-Option greyed out in ldap federation admin/ui #24958 Error handling in admin console when update of user fails due the 400 HTTP error code admin/ui #24961 Keycloak not able to handle multiple validating X509 certificates when public key are the same saml #24984 Operator is missing CRDs metadata in CSV operator #25008 Group search when creating user admin/ui #25022 NPE in checkAndBindMtlsHoKToken on Token Refresh when using SuppressRefreshTokenRotationExecutor and Certificate Bound Token oidc ## Apple already shipped attestation on the web, and we barely noticed DevFeed: [Apple already shipped attestation on the web, and we barely noticed]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-07-25T14:00:00Z Content type: opinion Language: en Sources: [HTTP Toolkit]() Topics: [Web](), [browser](), [HTTP](), [iOS](), [macOS](), [Cloudflare]() Tags: [apple](), [attestation](), [browser](), [browsers](), [chromium](), [cloudflare](), [http](), [ios](), [macos](), [public-key](), [server](), [web]() ### AI overview This opinion article examines Apple's Private Access Tokens, an attestation system integrated into macOS 13, iOS 16, and Safari. It explains how browsers, operating systems, attesters, and token issuers use HTTP challenges and signed tokens to verify that requests come from legitimate devices without disclosing the user's identity, while comparing the system with the proposed Web Environment Integrity model. ### Source excerpt There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being prototyped in Chromium. There's good reason for anger here (though I'm not sure yelling at people on GitHub is necessarily the best outlet). This proposal amounts to attestation on the web, limiting access to features or entire sites based on whether the client is approved by a trusted issuer. In practice, that will mean Apple, Microsoft & Google. Of course, Google isn't the first to think of this, but in fact they're not even the first to ship it. Apple already developed & deployed an extremely similar system last year, now integrated into MacOS 13, iOS 16 & Safari, called "Private Access Tokens": Private Access Tokens are powerful tools that prove when HTTP requests are coming from legitimate devices without disclosing someone's identity. The focus here is primarily on removing captchas, and as such it's been integrated into Cloudflare (discussed here) and Fastly (here) as a mechanism for recognizing 'real' clients without needing other captcha mechanisms. Fundamentally though, it's exactly the same concept: a way that web servers can demand your device prove it is a sufficiently 'legitimate' device before browsing the web. How do Private Access Tokens work? The mechanism is a fairly simple exchange over HTTP, handled by built-in browser APIs, which in turn integrate with operating system components to confirm that the browser & OS are 'legitimate' (the exact definition of that is left to the attester - i.e. Apple). The flow looks like this: A browser makes an HTTP request from a web server. The web server refuses the request, and returns an HTTP 401 response with a PrivateToken challenge: HTTP/1.1 401 Unauthorized WWW-Authenticate: PrivateToken challenge=, token-key= (Newlines added for readability) The browser recognizes this, and sends parts of the challenge, in addit ## How the EU Cyber Resilience Act would set cybersecurity requirements for software and connected products DevFeed: [How the EU Cyber Resilience Act would set cybersecurity requirements for software and connected products]() Original publisher: [Read original article]() Published: 2023-03-14T08:13:10Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Cybersecurity](), [Security](), [Code](), [Requirements](), [Software]() Tags: [business](), [chrome](), [code](), [cyber-resilience-act](), [cybersecurity](), [eu](), [europe](), [firefox](), [firewalls](), [hardware](), [innovation](), [linux](), [microcontrollers](), [public-key](), [requirements]() ### AI overview This commentary examines the EU Cyber Resilience Act (CRA), which would establish essential cybersecurity requirements for nearly all software and hardware with digital elements distributed in Europe. It discusses proposed secure-coding standards, third-party audits for certain critical products, and potential fines for non-adherence. ### Source excerpt First a round of thanks for the many people in industry and government who provided valuable links, background and insights! I could not have done this without your help! If you spot any mistakes, or have suggestions, please do contact me on bert@hubertnet.nl The EU's new Cyber Resilience Act is admirable in its goal. And the EU is not alone in thinking something needs to be done about the dreadful state of security online - the Biden administration has just released its National Cybersecurity Strategy that has similar aims. ## Authenticated encryption: why you need it and how it works DevFeed: [Authenticated encryption: why you need it and how it works]() Original publisher: [Read original article]() Author: andreacorbellini Published: 2023-03-09T18:35:00Z Content type: tutorial Language: en Sources: [Andrea Corbellini]() Topics: [Cryptography](), [Encryption](), [ChaCha](), [Algorithms]() Tags: [algorithms](), [cryptographic](), [cryptography](), [encryption](), [private-key](), [public-key](), [stream](), [xor]() ### AI overview This tutorial explains malleability in modern cryptographic ciphers and how authenticated encryption addresses it. It introduces symmetric ciphers, illustrates the issue with examples, and discusses ChaCha20-Poly1305 and AES-GCM. ### Source excerpt In this article I want to explore a common problem of modern cryptographic ciphers: malleability. I will explain that problem with some hands-on examples, and then look in detail at how that problem is solved through the use of authenticated encryption. I will describe in particular two algorithms that provide authenticated encryption: ChaCha20-Poly1305 and AES-GCM, and briefly mention some of their variants. The problem ... ## Securely booting user application in ESP Privilege Separation DevFeed: [Securely booting user application in ESP Privilege Separation]() Original publisher: [Read original article]() Author: John Lee Published: 2023-02-18T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [ESP-IDF](), [Security](), [Embedded Software Dev](), [Hardware]() Tags: [blog](), [embedded](), [esp-idf](), [esp-privilege-separation](), [esp32](), [firmware](), [hardware](), [iot](), [public-key](), [secure-boot](), [security](), [trust](), [verification]() ### AI overview This article describes certificate-based secure boot for user applications in the ESP Privilege Separation framework. It explains how protected and user applications can have independent update cycles and signing keys, and how the protected application verifies the user application when eFuse memory is scarce. ### Source excerpt In the previous post, we demonstrated the ability to independently update the user application in the ESP Privilege Separation framework. With the separation and isolation of the protected app and user app, it becomes convenient to decouple the ownership of each of these apps and their updates. This also potentially allows the possibility of having multiple user applications for a single protected application, somewhat like an "application store" for user app. ## Exposing AWS KMS Asymmetric Keys as a JWKS DevFeed: [Exposing AWS KMS Asymmetric Keys as a JWKS]() Original publisher: [Read original article]() Author: Brian Maloney Published: 2023-02-02T20:53:31Z Content type: tutorial Language: en Sources: [Benchling]() Topics: [OpenID connect (OIDC)](), [Authentication](), [Authorization](), [Security](), [Amazon Web Services](), [JSON Web Tokens](), [API](), [threat detection]() Tags: [api](), [authentication](), [authorization](), [aws](), [benchling](), [encryption](), [engineering](), [enterprise](), [identity](), [jwks](), [least-privilege](), [oauth](), [oauth-2-0](), [oauth2](), [oidc](), [openid-connect](), [private-key](), [public-key](), [secrets](), [security](), [threat-detection](), [token]() ### AI overview This Benchling article discusses service-to-service authentication with OAuth 2.0 and OpenID Connect. It explains why administrator-generated API tokens create secret-management, attribution, and least-privilege problems, and introduces private_key_jwt authentication with public-key cryptography while considering AWS KMS for private-key management and JWKS exposure. ### Source excerpt Here at Benchling, interaction with services is a large part of our business, from employees interacting with the software-as-a-service products with which we conduct our daily business, all the way down to interactions between the services that make up the Benchling application platform itself. Secure authentication and authorization to services is a long-standing issue in the industry, but one that has been improving in recent years due to the widespread adoption of modern standards such as OAuth 2.0 and OpenID Connect (OIDC). One specific use case for service-to-service authentication that is important to Benchling Security is connecting our Threat Detection Pipeline to our enterprise identity services vendor. We use this connection to connect log and other data provided by the vendor to our centralized Threat Detection Platform, where we correlate this with other sources of intelligence to detect risky or suspicious user activity in near real-time. Modern Authentication with OIDC Our specific identity services vendor offers two options for authenticating to its API: either an API token that an administrator can generate, or interaction by acting as an Application. API tokens, while very easy to use, are a poor choice for two reasons: First, they are a static secret that must be handled carefully and rotated frequently to mitigate the risk of a leaked key, which causes significant management overhead. Second, the identity services vendor links the privileges and identity of an API token inextricably to the administrator who generated it. This causes actions using the key to be attributed to the administrator and also makes it impossible to implement the principle of least privilege. Client authentication when acting as an Application allows the use of OIDC, and this vendor specifically requires the use of the private_key_jwt Client Authentication method. Enforcing this requirement is a good choice on the part of the vendor -- by using public-key encryption, no sec ## Ultimate Go: Advanced Engineering Episode 15 DevFeed: [Ultimate Go: Advanced Engineering Episode 15]() Original publisher: [Read original article]() Published: 2023-01-12T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Blockchain](), [Transactions](), [Ethereum]() Tags: [bitcoin](), [blockchain](), [digital-signature](), [ecdsa](), [ethereum](), [generate](), [go-blockchain](), [library](), [private-key](), [public-address](), [public-key](), [transactions]() ### AI overview This video tutorial explains how to derive a blockchain user's unique address from a public key recovered from a transaction signature. It covers reading the public key, validating the transaction's origin, and generating the user's address using Go Ethereum library functions. ### Source excerpt Introduction In episode 14, Bill architected a solution to digitally sign the transactions on his blockchain. His solution retrieved the private key by : loading private key data from disk, parsing the key data and returning the ECDSA private key. The private key is then used to generate the signature of a transaction. While writing the code to perform this functionality, Bill highlighted how a blockchain node can use a transaction's signature to extrapolate the public key. ## Creating Ethereum Digital Signatures with Go DevFeed: [Creating Ethereum Digital Signatures with Go]() Original publisher: [Read original article]() Published: 2023-01-11T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Blockchain](), [Ethereum](), [Transactions](), [Library]() Tags: [bitcoin](), [blockchain](), [code](), [digital-signature](), [ecdsa](), [ethereum](), [go](), [go-blockchain](), [library](), [private-key](), [public-key](), [signed-data](), [transactions]() ### AI overview A video tutorial demonstrating how to create Ethereum digital signatures with Go. It covers private ECDSA keys, signing objects, loading private keys from disk, decoding Ethereum signatures, and deriving public keys using the Go Ethereum library. ### Source excerpt Introduction In episode 13, Bill discussed the idea of adding salt to a hash and how modern crypto-currency blockchains use it to better interpret requests sent to nodes. He continued by defining a function called stamp that embeds a salt within a hash. While writing the function, Bill stated that he would use keccak256 as it's the same algorithm used by Ethereum to generate hash values. Bill will use the APIs provided with Go Ethereum to generate a keccak256 hash. He plans on reusing the stamp function in the future to digitally sign transactions performed on his blockchain. ## Issuing and using SSH Certificates DevFeed: [Issuing and using SSH Certificates]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2022-11-09T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [certificates](), [ssh](), [OpenSSH](), [Docker](), [configuration-management]() Tags: [certificates](), [configuration-management](), [docker](), [openssh](), [private-key](), [public-key](), [ssh]() ### AI overview This tutorial explains how SSH certificates let administrators control access to servers without managing authorized keys. It covers creating a Certificate Authority key pair, issuing short-lived user certificates, using certificates with private keys, and testing the setup with OpenSSH in Docker. ### Source excerpt SSH certificates allow system administrators to SSH into machines without having to manage authorized keys in the servers. ## The Complete Guide to iOS 16 Passkeys - App and Backend Implementation DevFeed: [The Complete Guide to iOS 16 Passkeys - App and Backend Implementation]() Original publisher: [Read original article]() Author: Allison Poppe Published: 2022-11-03T14:29:49Z Content type: tutorial Language: en Sources: [QuickBird Studios Blog]() Topics: [Passkeys](), [Authentication](), [iOS](), [WebAuthn](), [API](), [Back end]() Tags: [authentication](), [guide](), [ios](), [post](), [private-key](), [public-key](), [verification]() ### AI overview This tutorial explains how to integrate iOS 16 passkeys into an application, covering app-side authentication and the backend API endpoints needed to support registration and sign-in. It describes passkeys as Apple's implementation of WebAuthn and explains that authentication uses a public key stored on the server while the private key remains on the user's device. ### Source excerpt With iOS 16 Apple introduced a way to go passwordless called Passkeys. In this article, we are covering what needs to be done on the app side but also what needs to be implemented in the backend The post The Complete Guide to iOS 16 Passkeys - App and Backend Implementation appeared first on QuickBird Studios. ## How to Access Infrastructure Without Usernames and Passwords DevFeed: [How to Access Infrastructure Without Usernames and Passwords]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-07-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [passwords](), [Authentication](), [Security](), [private key](), [ssh](), [public key](), [Vulnerabilities]() Tags: [authentication](), [infrastructure](), [passwords](), [private-key](), [public-key](), [security](), [ssh](), [vulnerabilities]() ### AI overview The article argues that passwords, private keys, API keys, and other secrets create risks through sharing, loss, theft, leakage, and human error. It presents identity-based access as a way to consolidate authentication for growing teams and infrastructure. ### Source excerpt Announcing the release of Teleport 10.0 which adds support for passwordless logins to infrastructure. ## WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication DevFeed: [WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-07-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [WebAuthn](), [Authentication](), [public key](), [browsers](), [Security](), [W3C]() Tags: [authentication](), [browsers](), [protocol](), [public-key](), [security](), [w3c](), [web]() ### AI overview This tutorial explains WebAuthn as a public-key authentication API for web browsers. It introduces the relationship between WebAuthn, FIDO2, the W3C specification, and CTAP, and describes the components required for passwordless authentication. ### Source excerpt This post introduces basic concepts and details related to WebAuthn. ## SSH Certificates: How Do OpenSSH Certificates Compare to X.509? DevFeed: [SSH Certificates: How Do OpenSSH Certificates Compare to X.509?]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-06-23T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [certificates](), [Authentication](), [public key]() Tags: [authentication](), [certificates](), [openssh](), [public-key](), [security]() ### AI overview This article explains how OpenSSH certificates differ from X.509 certificates. It describes OpenSSH's custom certificate format and certificate-based authentication flow, including CA signing, certificate validation, expiration checks, and security constraints. ### Source excerpt Learn how OpenSSH certificates differ from X.509. ## How to Configure SSH Certificate-Based Authentication DevFeed: [How to Configure SSH Certificate-Based Authentication]() Original publisher: [Read original article]() Author: info@goteleport.com (Honda McLaren) Published: 2022-04-26T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [certificates](), [OpenSSH](), [Tutorial](), [Security](), [public key](), [private key]() Tags: [authentication](), [certificates](), [openssh](), [private-key](), [protocol](), [public-key](), [security](), [ssh](), [tutorial]() ### AI overview This tutorial explains how to configure SSH certificate-based authentication for an OpenSSH server. It contrasts static SSH keys with short-lived, CA-signed certificates that include identity, expiration, and policy controls, and outlines how servers validate certificates. ### Source excerpt Learn how to configure SSH certificate-based authentication in OpenSSH using short-lived, CA-signed certificates to replace static SSH keys and improve security. ## SSH Keys Compared: RSA, ECDSA, Ed25519 DevFeed: [SSH Keys Compared: RSA, ECDSA, Ed25519]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-04-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [Cryptography](), [Authentication](), [public key](), [private key](), [certificates](), [Post-Quantum]() Tags: [authentication](), [certificates](), [cryptography](), [ecdsa](), [ed25519](), [openssh](), [post-quantum](), [private-key](), [public-key](), [rsa](), [ssh]() ### AI overview A guide to SSH public-key authentication that compares RSA, ECDSA, and EdDSA (Ed25519), recommends Ed25519 for most uses, and discusses older-system compatibility, key generation, fingerprints, rotation, and certificates. ### Source excerpt Comparing SSH keys: RSA, DSA, ECDSA, and Ed25519 explained, with a straight algorithm recommendation and the move from keys to certificates. Read on. [Next page]()