KeypMe

Why using KeypMe over FIDO2 USB token / Smartcard?

FIDO2 USB tokens and smartcards have a high CapEx. Using them in an organization with high turnover is very costly.
In addition to the hardware price, there are logistics costs (ordering, storing, dispatching) and the cost of handing them out to new joiners.
KeypMe, in contrast, is mainly OpEx.

KeypMe smartphone-based solution significantly reduces onboarding cost of new employees. Onboarding can be done on employee's smartphone.
It also reduces the number of forgotten FIDO2 devices. Both reduce IT helpdesk costs.

FIDO2 smartcard also requires the computer to have a card reader. KeypMe also has smartcard support (PIV, OpenPGP) but does not require a hardware reader. When connected to the computer, the smartphone is recognized as a fully compliant smartcard.

Why using KeypMe over native Android/iOS FIDO2 authenticator support in an enterprise environment?

All native Android/iOS FIDO2 authenticators create their FIDO2/Passkey in the cloud (sync Passkey). They are not device-bound keys. It means the FIDO2 key could be re-used by another person on another smartphone using the same Google/iCloud account, thus opening the door to an untrusted person.
KeypMe, in contrast, creates credentials in device-bound secure hardware. FIDO2 credentials created by KeypMe cannot be shared.

Native Android/iOS FIDO2 authenticators also lack support for FIDO2 Enterprise Attestation that can be used to control and restrict which FIDO2 Authenticator is used to access the organization resources.
KeypMe supports FIDO2 Enterprise Attestation.

Why using KeypMe for IT/OT Convergence?

Hybrid FIDO2 transport (QR code generation and presentation) is not suited to physical access.. It requires the door access control card reader to have a screen to present the generated QR code.
For physical access, the FIDO2 token must support NFC or Bluetooth.
It means native Android/iOS FIDO2 support and Microsoft authenticator cannot be used for physical access (the same applies to USB-only FIDO2 tokens). KeypMe supports both Bluetooth and NFC that makes it suitable for physical access.

Your OT infrastructure might also need to be resilient to network outages. Physical access may need to keep working even when the network is down. FIDO2 has an optional feature named pseudo-random function (PRF) that is supported by KeypMe. This feature derives a symmetric key from a FIDO2 credential. This symmetric key can be used for offline authentication.
In addition, KeypMe also supports smartcard that are totally adapted to offline authentication.

KeypMe can verify user identity through a national mobile identity wallet or a passeport/citizen ID card.
New users can be onboarded through their smartphone, which reduces long queues at the IT desk when many people are joining or waiting for a replacement card/token/etc.

In critical infrastructure, the use of sync FIDO2/Passkey credentials (such as used by native Android and iOS phone) should be restricted by policy.. Sync FIDO2 credentials could easily be reused by a non-trusted person.

KeypMe features that could make a difference

KeypMe supports the FIDO2 credBlob and largeBlob extensions. These extensions allow to add additional custom data to FIDO2/Passkey credentials.

KeypMe has smartcard support. While FIDO2/Passkey standard has been created to make easy passwordless experience for the user, FIDO2/Passkey are not always adapted to enterprise requirements. In the meantime, smartcard standard exists for decades and by its features such as PKI integration, key/certificate periodical rotation make it particularly adapted to enterprise requirements. It can also work offline.
Smartcard support enables use cases beyond user authentication (the only FIDO2 use case): digitally signing emails and documents, and encrypting files.

KeypMe has supported Post-Quantum Cryptography (PQC) for some time. It stores cryptographic keys only in secure hardware: Secure Element on smartphone, TPM on computer and also support external HSM. Because few smartphones support PQC yet, by leveraging external HSM, KeypMe can offer Post-Quantum cryptography authentication on older smartphone models.
Post-Quantum cryptography is not supported yet by FIDO2 specification. But as soon as the specification is released, KeypMe will be able to support it - unlike FIDO2 USB tokens and smartcards, which would have to be replaced.

KeypMe can be integrated into your own company mobile application as it is packaged as an SDK. A KeypMe white label license exists.