1) The FIDO Alliance authentication certification program evaluates and certifies authenticators at different security levels to create trust between relying parties and authenticators. 2) Higher certification levels provide defenses against more sophisticated attacks, with Level 3+ providing the highest security against physical attacks on authenticator devices. 3) The certification process involves security reviews and penetration testing conducted by accredited laboratories. Companion certification programs can reduce the cost and time of certification for vendors.

1. Overview of FIDO
Security Requirements
and Certification
Laurence Lundblade
Sec uri ty Spec i a li s t, DO CO MO Inno va ti o ns Inc
December 2018
2018 FIDO Certification LGL v6

2. 2
AUTHENTICATOR SECURITY CERTIFICATION
IS IMPORTANT FOR FIDO
AuthenticatorUser verification FIDO Authentication
The authenticator
stores private keys
and biometric
templates
FIDO relies on the security of the
Authenticator to protect biometrics,
PINs and cryptographic keys
All Rights Reserved | FIDO Alliance | Copyright 2018

3. 3
CERTIFICATION CREATES A TRUST ECOSYSTEM
Trusts
Relying Parties can trust
Authenticators purchased
directly by consumers
Evaluates
& Certifies
Relying
Party
…
Authenticator
Authenticator
Authenticator
…
FIDO Alliance
Authenticator Security
Certification Program
All Rights Reserved | FIDO Alliance | Copyright 2018

4. Certi fi c a tio n i s o f a uthenti c ato r i n fi na l pro duc t
purc ha s ed by the c o ns um er
• C o n s u m e r d o e s n o t h a v e t o c o n f i g u r e o r o p e r a t e t h e
a u t h e n t i c a t o r s e c u r e l y
• C o n s u m e r c a n n o t m o d i f y t h e a u t h e n t i c a t o r s o a s t o m a k e
i t w e a k e r
Certi fi c a tio n c o vers full a uthenti ca to r func ti o na li ty
Relyi ng party can trust a certi fi ed authenti cator even i f
they do n’t kno w i ts m a ke a nd m o del
CERTIFICATION OF END CONSUMER DEVICE
All Rights Reserved | FIDO Alliance | Copyright 2018

5. 1. Platform Built-in 2. In TEE
3. In Application 4. Security Key
TEE
App
5
SECURITY CERTIFICATION OF AUTHENTICATOR ONLY
Platform
Authenticator
Authenticator
Platform
Browser Authenticator
Platform
Browser
Authenticator
App
Platform
The Authenticator is the security
core
• Protects keys and biometrics
Small enough to be practically
certifiable
Can be built on other components
that are certified
• TEE (Trusted Execution
Environment), Secure Element…
The platform itself is not certified
for security, just the authenticator
part
USB/ BLE/NFC
Browser App
Browser App
CTAP
All Rights Reserved | FIDO Alliance | Copyright 2018

6. 6
A COMPREHENSIVE SET OF LEVELS FOR ALL USES CASES
SAMPLE DEVICE HARDWARE &
SOFTWARE REQUIREMENTS
DEFENDS AGAINST
Protection against chip fault injection,
invasive attacks… L3+
Captured devices
(chip-level attacks)
Circuit board potting, package on
package memory, encrypted RAM… L3
Captured devices
(circuit board level attacks)
Restricted Operating Environment (ROE)
(e.g., TEE or Secure Element in a phone,
USB token or Smart Card which are
intrinsically ROEs, other…)
L2+
Device OS compromise
(defended by ROE)
L2
Any device HW or SW
L1+
Device OS compromise
(defended by white-box cryptography)
L1
Phishing, server credential
breaches & MiTM attacks
(better than passwords)
All Rights Reserved | FIDO Alliance | Copyright 2018

7. 7
LEVEL 1
Examples
• Android or iOS applications
• Platform built-in authenticators
• Level 2- or Level 3-capable
authenticators that have not been
certified at Level 2 or Level 3 yet
• Better than passwords
• FIDO is unphishable and biometrics
are more convenient
• Keys and biometric templates are
protected similar to passwords
stored by a browser or password
manager app
• Requires best facilities offered by
hosting OS
• L1+ adds white-box cryptography,
obfuscation and other techniques
to defend against compromise of
hosting OS
L1 Certification Process L1+ (in development)
Vendor Create detailed design document
Lab No lab at L1 Penetration testing
FIDO Design Review,
Administration
Administration
All Rights Reserved | FIDO Alliance | Copyright 2018

8. 8
LEVEL 2
In addition to L1
• A restricted operating
environment like a TEE gives
security even if OS is
compromised.
• Separate USB, BLE and NFC
authenticators are considered
to use a restricted operating
environment
• Gives defense against larger
scale attacks
• Additional assurance at L2+
Examples
• Android apps using FIDO Level 2 certified
phone (there aren’t any yet)
• USB, BLE and NFC Security Keys
• Level 3-capable authenticators that
haven’t yet been certified at Level 3
L2 Certification Process L2+ (in development)
Vendor Create detailed
design document
Supply source code
Lab Design Review Penetration testing,
Attack potential calculation
FIDO Administration Administration
All Rights Reserved | FIDO Alliance | Copyright 2018

9. 9
LEVEL 3
In addition to L2
• Defends against physically
captured authenticators
• Defenses against disassembling,
probing, glitching and other such
physical attacks
• L3+ adds defense against chip-level
physical attacks, such as decapping
and probing the chip
Examples
• USB, BLE and NFC Security Keys using
Secure Elements or other means of
defending HW attacks
• Some phone & platform authenticators
may achieve L3, but it is uncommon
L3 & L3+ Certification Process
Vendor Create detailed design document,
Supply source code
Lab Design Review, Penetration testing, Attack
potential calculation
FIDO Administration
All Rights Reserved | FIDO Alliance | Copyright 2018

10. 10
COMPANION PROGRAMS
Re use as much as possible from other programs like
Common Criteria
• Reduces time, effort and cost of certification for authenticator
vendors, sometimes by quite a lot
Companion programs never cover all FIDO requirements;
they were not developed specifically for authenticators
• Even with advanced companion programs, vendors will have to
go through additional certification with the FIDO Alliance
Companion Program FIDO Security Level Program Status
Common Criteria AVA_VAN 3 L3 Operating
Common Criteria AVA_VAN 4 L3+ Operating
FIPS L2+, L3 In development
Global Platform TEE Protection Profile L2+ In development
Authentication-
specific
Companion program
AllFIDOSecurityRequirements
End-device
configuration
Cryptographic
algorithms
FIDOSpecific
All Rights Reserved | FIDO Alliance | Copyright 2018

11. 11
BIOMETRIC COMPONENT CERTIFICATION
• First of its kind program to empirically
• validate biometric components through
Third-Party Labs and assure that they
Correctly Identify Users Regardless of
Biometric Modality on All FIDO
Implementation Types
All Rights Reserved | FIDO Alliance | Copyright 2018

12. 12
FIDO ACCREDITED LABS
L2
All labs that do FIDO certification must pass accreditation by the FIDO Alliance
L2, L3, L3+
Biometric
List as of
December 2018
All Rights Reserved | FIDO Alliance | Copyright 2018

13. 13
EXPIRATION, DERIVATIVE & DELTA CERTIFICATION
Phone Model-1 32GB
Authenticator v1
Phone Model-1 64GB
Authenticator v1
Phone Model-2 32GB
Authenticator v1
Phone Model-3 32GB
Authenticator v2
Security Requirements 1.2 Security Requirements 1.3
Phone Model-1 64GB
Authenticator v1
Delta Certification
• When the FIDO functionality changes
• Recertification against new requirements
• After fix to close a vulnerability
• Reevaluation of security is required
Derivative certification
• No change to FIDO functionality allowed
• Surrounding functionality may change
• Packaging & product name may change
• No reevaluation of security
No Expiration
• Certification of a given product never
expires
• Recertification against new versions of
the requirements is optional
Derivative
Delta
Derivative
Delta
Phone Model-1 64GB
Authenticator v1.1 (fixed)
Delta
All Rights Reserved | FIDO Alliance | Copyright 2018

14. • Requirements are set by a 2/3 vote of the Security Requirements
Working Group which is broadly made up of:
• Authenticator and technology vendors
• Relying parties
• Certification labs
• Industry and government organizations
• FIDO Alliance members can participate
• Requirements documents are public and open
• Security Requirements
• Allowed Cryptography
• Allowed Restricted Operating Environments
• Metadata Requirements
14
CREATION AND GOVERNANCE OF REQUIREMENTS
Others…
All Rights Reserved | FIDO Alliance | Copyright 2018

15. All Rights Reserved | FIDO Alliance | Copyright 201815
Connect with FIDO
fidoalliance.org