FIDO (Fast Identity Online) is an open authentication standard developed by the FIDO Alliance, a group of leading technology companies including Google, Microsoft, Apple, Yubico, Samsung, and others. They work together to achieve a common goal: making digital authentication secure, compatible, and easy to use. 

The fundamental principles of FIDO 

• No more passwords: Instead of remembering something, users rely on a physical security key or biometric features like fingerprints or facial recognition. A fingerprint or security key by itself is not the actual passkey, though, just the key that unlocks the passkey lock.
• Secure through technology: FIDO uses modern encryption technology. A secure key pair is generated, with one part stored on the device, or in a digital keychain, and the other with the provider.
• Authenticating directly on the device: Identity is verified locally, such as through the smartphone or a hardware token, and is not transmitted over the Internet.
• Protection against phishing: Since no sensitive data, such as passwords, is entered or transmitted, phishing attacks are ineffective. In fact, passwords do not even exist in a setup like this. 

These principles make FIDO a true alternative to traditional passwords, not just in security but also in user convenience. Instead of remembering or constantly resetting passwords, authentication is easily done with biometric features or security keys. This results in a faster, more secure, and simpler login process for both IT security and user experience. 

FIDO-based authentication with passkeys employs an asymmetric encryption method involving a key pair. 

1. Registration 
   Users log in using their registered security key (e.g., a YubiKey) or a device-bound passkey (such as the TPM module in Windows computers or the secure enclave in Macs), usually unlocked through biometrics. A key pair is generated in the process.
   1. The private key remains securely on the device, security key, or digital keychain (cannot be exported)
   2. The public key is transmitted to the service provider and stored there 
       
2. Login and authentication 
   When logging in, the service issues a challenge that is digitally signed locally by the user's device using the private key. 
   The server then verifies the signature with the stored public key. 
    
3. Local verification with biometric security 
   The private key can only be used if the user authenticates locally on the device, such as using biometric features or a PIN. This guarantees that access is given only to an authorized user. 
    
4. No password required 
   No password is needed or ever transmitted. This makes the method resistant to phishing, credential theft, and replay attacks. 

This architecture prevents 

• Man-in-the-middle attacks are prevented because the private key stays on the device, and the signature is created locally.
• Replay attacks, as a new, unique challenge, are used for each login
• Theft of passwords because there are no passwords that could be tapped or guessed