Enterprise Passkey Migration: FIDO2 WebAuthn Architecture, Account Recovery, and Phishing Defense

## The Cryptographic Mechanics of FIDO2 Passkeys

Passkeys replace shared secrets (passwords and symmetric OTP seeds) with public-key cryptography. The user's device generates an asymmetric key pair within its Secure Enclave (Apple) or TPM 2.0 (Windows), transmitting only the public key to the Relying Party.

### 1. Authentication Security Matrix

| Authentication Method | Phishing Resistance | Credential Stuffing Risk | SIM-Swap Vulnerability | Enterprise Deployment Friction |
|:----------------------|:-------------------:|:------------------------:|:----------------------:|:------------------------------:|
| Password + SMS OTP | None | Moderate | High | Low |
| Password + TOTP (App) | Low (AitM Proxies) | Low | None | Moderate |
| Push Notification MFA | Low (Fatigue Attacks) | Low | None | Low |
| FIDO2 / WebAuthn Passkeys | Total (Origin Bound) | Zero | None | Moderate |

### 2. Challenge Verification Invariant

```python
def verify_webauthn_challenge(client_data_json: str, expected_origin: str, expected_challenge: str) -> bool:
import json, base64
parsed = json.loads(client_data_json)
assert parsed.get("type") == "webauthn.get"
assert parsed.get("origin") == expected_origin
assert parsed.get("challenge") == expected_challenge
return True
```