Unverified50% confidenceFactExact time
Passkeys' private keys are stored in the user device's trusted execution environment (TEE) or hardware security module (HSM), and the server only stores the public key.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Passkeys 不是陷阱：解读无密码登录的真实争议
Related Entities
Related Claims
UnverifiedSSH密钥认证过程中私钥永远不离开本地设备，即便服务器被入侵，攻击者获得的公钥也无法反推私钥80% similarUnverifiedWhen logging in with Passkeys, the server sends a random challenge, the device signs it with the private key and returns the result, and the server verifies the signature with the public key; since the private key is never transmitted, identity cannot be forged even if the server database is stolen.79% similarUnverifiedPrivate keys are typically bound to a device's security chip (such as Android's StrongBox or TEE Trusted Execution Environment).78% similarUnverifiedAWS KMS使用硬件安全模块（HSM）保护主密钥，支持密钥自动轮换和细粒度IAM访问控制77% similarVerifiedSSH key authentication is based on asymmetric encryption principles, where the private key is kept locally and the public key is uploaded to the server, with no password transmission throughout the process, making it more secure than HTTPS username and password authentication77% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1029140API
curl https://kongchang.com/api/v1/knowledge/claims/1029140MCP
get_claim(id=1029140)