A wireless authentication system for authenticating a user before allowing access to a protected resource is described herein. An authentication device receives an indication of an intent to access a protected resource. The authentication device sends a request for a key. The wireless user device and the authentication device may engage in a key exchange. The authentication device determines whether the one or more keys obtained via the key exchange are valid and may allow access to the protected resource if the one or more keys are valid. The authentication device may request further verification of the identity of the user, such as a keyholder verification. The authentication device may allow access to the protected resource if the key and the keyholder verification are valid.