Limitation of Passkey Cross-Device Authentication (CDA) in Captive Portal Deployments

Zyxel_Richard

Overview

Passkey authentication supports Cross-Device Authentication (CDA), allowing users to authenticate on one device using a passkey stored on another device, such as using an iPhone to sign in on a Windows laptop. CDA on apple devices like iPhone relies on QR code scanning, Bluetooth proximity verification, and an Internet-based relay channel to complete the authentication process.

Limitation in Captive Portal Environments

In a Captive Portal deployment, a client device is typically blocked from Internet access until authentication is successfully completed.

As a result, Cross-Device Authentication (CDA) may not function as expected:

1. The client device displays a QR code for passkey authentication.
2. The user's mobile device scans the QR code.
3. CDA attempts to establish a secure authentication channel between the client device and the mobile device.
4. However, the client device has not yet been granted Internet access because it is still unauthenticated.
5. The CDA process cannot complete, causing authentication or add passkey process fail.

Why This Happens

Although CDA uses Bluetooth to verify that the two devices are in close proximity, Bluetooth is not used as the primary communication channel for the authentication exchange. The authentication transaction is carried over an encrypted Internet-based relay service. If either device cannot reach the Internet, the CDA flow cannot be completed.

Affected Scenarios

The limitation may occur in situations such as:

• Adding / Using a passkey on an iPhone to sign in from a laptop connected to a Captive Portal network.
• Any Passkey "Use another device" or QR-code-based sign-in flow before network access is granted.