# Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics
## 3 Methods
### Implementation
#### 3.2.3 Post-Installation  
* SA User registration (SAUR) The user is presented with the typing behaviour capture screen, where their TP is recorded by the TypingDNA library implemented on the page. Before these data is sent to the server, biometric authentication is requested on the user's device by prompting for either a fingerprint or face ID, depending on that which was previously set up by the user. The SA app is designed to work only on devices with biometric authentication capability. Once the user's biometric information is confirmed, along with the unique ID received during the installation stage, the TP is encrypted with the server's public key and sent to the server for onward transmission to TypingDNA's API to be recorded. The TP is then identified for that user via the unique ID. The user is prompted to enter a predefined text (their email address) a minimum of three times to ensure that enough patterns are captured to be able to create a model for the user [26]. We have chosen to integrate two elements of FIDO (Fast Identity Online), namely, fingerprint and face ID, and have enhanced security by incorporating steganography alongside FIDO. While this approach reduces deployability compared to using just FIDO, it enhances system security. Rather than relying solely on external hardware for security, we are leveraging software-based methods to strengthen security measures. As depicted in Figure 3, once a response from the API signals that enough patterns have been received to verify the user, the unique ID is then saved as the user's typing ID along with the app public key in the database. The user is subsequently routed to ALS. * Account registration (e.g., an e-commerce website--\"Ecom\") Before a user can add an account to the app, the service (hereafter referred to as \"Ecom\") they wish to add must have implemented the SA scheme. This is achieved by Ecom creating authenticated API endpoints on their server to receive requests from the SA server. With this implementation, usernames are associated with public keys rather than passwords. This ensures that if Ecom is breached, they hold a database of public keys rather than passwords or hashes, and usernames. The registration flow for new Ecom users differs from that of existing password-based users migrating to passwordless authentication and is described below. Figure 2: SA app installation process flow. * SA server generates a unique registration ID for the username and serves it as a response to the Ecom server's request. * Ecom delivers the unique registration ID to the user embedded in a download link of the SA app. * When the user downloads and launches the app; the process described in Section 3.2.2 occurs. * SA server generates a unique registration ID for the username and serves it as a response to the Ecom server's request. * Ecom delivers the unique registration ID to the user embedded in a download link of the SA app. * When the user downloads and launches the app; the process described in Section 3.2.2 occurs. In addition, a 2048-bit RSA key pair is generated for the username. * SA server generates a unique registration ID for the username and serves it as a response to the Ecom server's request. account. Each account on the SA app has a key pair separate from the key pair of the app. The user is automatically routed to the NAS with the service name (Ecom) and username pre-filled. The user then needs to upload an image where the public key for that account and their typing ID will be embedded. When they click on the option to add the account, biometric authentication is requested by prompting the user for their fingerprint or face-ID. On successful biometric authentication, the SA app sends the app public key, account public key, registration ID, and image file to the SA server. The server extracts the typing ID previously saved to the app public key (as described in Section 3.2.3--SAUR), encrypts it with the server private key, and embeds the encrypted typing ID and account public key in the image provided using steganography.