Download as PDF, PPTX
Uploaded byFIDO Alliance
FIDO Specifications Tutorial
The document outlines the FIDO (Fast Identity Online) authentication framework, highlighting security vulnerabilities associated with traditional password systems and demonstrating how FIDO addresses these issues through user verification methods and public key cryptography. It explains the process of FIDO registration and authentication, emphasizing the need for a user gesture and the secure management of cryptographic keys. The conclusion stresses FIDO's capability to provide scalable convenience and security while supporting diverse user verification methods.
More Related Content
Similar to FIDO Specifications Tutorial
More from FIDO Alliance
FIDO Specifications Tutorial
- 1. FIDO SPECIFICATION TUTORIAL JerrodChong, Yubico All Rights Reserved | FIDO Alliance | Copyright 2016
- 2. How Secure isAuthentication? 2All Rights Reserved | FIDO Alliance | Copyright 2016. Passwords Broken Phishing Widespread Existing Options Inadequate
- 3. Online Authentication 3 DeviceSomething Authentication RiskAnalytics Internet All Rights Reserved | FIDO Alliance | Copyright 2016.
- 4. Password Issues 4 DeviceSomething Authentication Internet Passwordcould be stolen from the server 1Password might be entered into untrusted App / Web- site (“phishing”) 2 Too many passwords to remember (>re-use / cart Abandonment) 3 Inconvenient to type password on phone 4 All Rights Reserved | FIDO Alliance | Copyright 2016.
- 5. Classifying Threats 5 Remotely attackingcentral servers steal data for impersonation Remotely attacking lots of user devices steal data for impersonation Remotely attacking lots of user devices misuse them for impersonation Remotely attacking lots of user devices misuse authenticated sessions Physically attacking user devices steal data for impersonation Physically attacking user devices misuse them for impersonation 1 2 3 4 5 6 All Rights Reserved | FIDO Alliance | Copyright 2016. Scalable 63% of confirmed data breaches involved leveraging weak/default/stolen passwords * * 2016 Verizon Data Breach
- 6. How does FIDOwork? 6 AuthenticatorUser verification FIDO Authentication Require user gesture before private key can be used Challenge (Signed) Response Private key dedicated to one app Public key All Rights Reserved | FIDO Alliance | Copyright 2016.
- 7. How does FIDOwork? 7 AuthenticatorUser verification FIDO Authentication …SE All Rights Reserved | FIDO Alliance | Copyright 2016.
- 8. How does FIDOwork? 8 AuthenticatorUser verification FIDO Authentication Same Authenticator as registered before? Same User as enrolled before? All Rights Reserved | FIDO Alliance | Copyright 2016.
- 9. How does FIDOwork? 9 AuthenticatorUser verification FIDO Authentication …SE How is the key protected (TPM, SE, TEE, …)? Which user verification method is used? All Rights Reserved | FIDO Alliance | Copyright 2016.
- 10. FIDO ServerFIDO Authenticator Metadata Signed Attestation Object Verify TrustAnchor (Available from Metadata Service or Other Source) Understand Authenticator Characteristic (Using Info From Metadata or Other Source) ATTESTATION & METADATA 20Confidential
- 11. 11 Single Factor Experience(UAF Standards) Authenticated Online 3 Biometric User Verification* 21 ? Authentication Challenge Authenticated Online 3 Second Factor Challenge Insert Dongle* / Press Button Second Factor Experience (U2F Standards) *There are other types of authenticators 21 All Rights Reserved | FIDO Alliance | Copyright 2016.
- 12. U2F Device Client Relying Party challenge challenge Sign with kpriv signature(challenge) s Check signature(s) using kpub s Lookup kpub Authentication
- 13. U2F Device Client Relying Party challenge challenge, origin,channel id Sign with kpriv signature(c) c, s Check s using kpub Verify origin & channel id s Lookup kpub Phishing/MitM Protection
- 14. U2F Device Client Relying Party handle, appid, challenge h, a; challenge, origin, channel id, etc. c a Check app id Lookup the kpriv associated with h Sign with kpriv signature(a,c) c, s Check s using kpub Verify origin & channel id s h Lookup the kpub associated with h Application-Specific Keys
- 15. U2F Device Client Relying Party app id,challenge a; challenge, origin, channel id, etc. c a Check app id Generate: kpub kpriv handle h kpub, h, attestation cert, signature(a,c,kpub,h) c, kpub, h, attestation cert, s Associate kpub with handle h for user s Registration + Device Attestation
- 16. 16 Authenticated Online 3 Biometric User Verification* 2 Single FactorExperience (UAF Standards) 1 ? Authentication Challenge Authenticated Online 3 Second Factor Challenge Insert Dongle* / Press Button Second Factor Experience (U2F Standards) 1 2 *There are other types of authenticators All Rights Reserved | FIDO Alliance | Copyright 2016.
- 17. Registration Overview 17 Perform legacyauthentication first, in order to bind authenticator to an electronic identity, then perform FIDO registration. FIDO CLIENT FIDO AUTHENTICATOR FIDO SERVER Verify user Generate key pair Sign attestation object: • Public key • AAID • Hash(FinalChallenge) • Name of relying party Signed by attestation key Send Registration Request: • Policy • Random Challenge Verify signature Check AAID against policy Store public key Start registration AAID = Authenticator Attestation ID, i.e. model ID FinalChallenge=AppID | FacetID | channelBinding | serveChallenge All Rights Reserved | FIDO Alliance | Copyright 2016.
- 18. Authentication Overview 18 FIDO CLIENT FIDOAUTHENTICATOR FIDO SERVER Verify user Opt: Display TransactionText Sign signData object: Signature alg • Hash(FinalChallenge) • Opt: Hash(TransactionText) • Signature counter Authenticator random Signature (Uauth key) Send Authentication Request: • Policy • Random Challenge • Opt: TransactionText Verify signature Check AAID against policy Start authentication FinalChallenge=AppID | FacetID | channelBinding | serveChallenge All Rights Reserved | FIDO Alliance | Copyright 2016.
- 19. Convenience & Security 19 Security Convenience Password+ OTP Password All Rights Reserved | FIDO Alliance | Copyright 2016.
- 20. Common Authentication Stack 20 Security Convenience Password+ OTP Password FIDO In FIDO: Same user verification method for all servers In FIDO: Arbitrary user verification methods are supported and interoperable All Rights Reserved | FIDO Alliance | Copyright 2016.
- 21. Scalable 21 Security Convenience Password + OTP Password FIDO InFIDO: Scalable security depending on Authenticator implementation In FIDO: • Only public keys on server • One authenticator to many services • Not phishable All Rights Reserved | FIDO Alliance | Copyright 2016.
- 22. Conclusion • Different authenticationuse-cases lead to different authentication requirements • FIDO separates user verification from authentication and hence supports all user verification methods • Simple, Single gesture authentication • FIDO supports scalable convenience & security • User verification data is known to Authenticator only • FIDO complements federation 22All Rights Reserved | FIDO Alliance | Copyright 2016.