NEW YORK · LONDON · HONG KONG · DUBAI
Passkey-bound encryption, normalised across every platform. The standard underneath every IMS Labs application.
From user biometric / PIN authentication to sensitive user data protection — the full passkey based, end to end solution every IMS Labs application inherits
Enterprises are shipping passkeys. Regulators ratified the highest assurance level. Governments are retiring SMS as a factor. Three signals from three different parts of the stack.
Built on WebAuthn and FIDO2. Backed by Apple, Google, Microsoft, Yubico. The private key never leaves the device.
The server issues a challenge. The user's device signs it with a private key that never leaves the secure enclave. The server verifies against a stored public key.
WEBAUTHN · FIDO2 · CTAP 2.2Passwords leak through phishing, breach, reuse, and shoulder-surfing. Passkeys can't leak. There's nothing to leak. The cryptographic root is hardware-bound.
NIST AAL3 · PHISHING-RESISTANTPasskey is the visible surface. Underneath, the spec is rapidly extending into payments, credentials, and agent authorisation.
FIDO ALLIANCE · IETF · W3CPasskeys can do more than log you in. They can also unlock encryption keys for your data. The standard made that part optional, so each browser shipped a different implementation. Same standard, four different behaviours.
One word — MAY — and every browser interprets it differently. Chrome supports it fully. Safari, iOS, and Android each ship a partial version.
Keystone normalises every authenticator behaviour. The same passkey unlocks the same data, whether the user is on iPhone, MacBook, Android, or YubiKey. Drop-in for every IMS Labs surface.
Non-custodial by default. Optional custodial recovery. Same clean code path on every platform and hardware key.
WebAuthn PRF lets passkeys derive encryption keys. The spec exists, the implementations don't agree. Keystone is the proprietary layer that makes one code path work everywhere.
FRAGMENTED → UNIFIEDKeystone isn't a separate product. It's the authentication and encryption layer underneath everything we ship.
LP and GP authentication, per-user encrypted data rooms, optional custodial recovery.
Operator and analyst access. Standardising across every Cortex surface.
Every new application ships with Keystone as the auth and encryption baseline.
Same passkey authenticates and decrypts. Zero-knowledge on the server.
WebAuthn requires a user-presence gesture. AI agents can't provide one. The temptation is to break the spec or run a service-account passkey. We don't.
Humans authenticate via passkey. Agents act under scoped, time-limited OAuth 2.1 tokens delegated by the human. Audit trail stays clean. Standard stays intact.
Keystone is live. Agent protocols, verifiable credentials, and content provenance are next.
The first product built on Keystone. The pattern every future IMS Labs application inherits.