Explore how FIDO UAF works and how FIDO is used in the world today. The FIDO Alliance invites you to learn how simplify strong authentication for web services. FIDO specifications can help all organizations, especially service providers who want to scale these features for consumer services over the web. Essentially, FIDO offers a simple, low-cost way to improve security and the online experience.

1. UAF Protocol

3. Internet is Global
120m
289m
1.3bn Users
300m
160m
300m
#Users 2014
Google: 2013
Twitter: 2015

4. Devices without physical keyboard

5. How Secure is Authentication?

6. Cloud Authentication

7. Password might be
entered into untrusted
App / Web-site
(“phishing”)
Password could be stolen
from the server
Too many passwords to
remember
 re-use / cart
abandonment
Inconvenient to type
password on phone
Password Issues

8. OTP Issues
OTP vulnerable to real-
time MITM and MITB
attacks
SMS security questionable,
especially when Device is the
phone
OTP HW tokens are
expensive and people
don’t want another device
Inconvenient to type OTP
on phone

10. Attack Classes
Remotely attacking central servers
steal data for impersonation
1
Physically attacking user
devices
misuse them for
impersonation
6
Physically attacking user
devices
steal data for impersonation
5
Remotely attacking
lots of user devices
steal data for
impersonation
Remotely attacking
lots of user devices
misuse them for
impersonation
Remotely attacking
lots of user devices
misuse
authenticated
sessions
2 3 4
Scalable attacks
Physical attacks
possible on lost or
stolen devices
(3% in the US in 2013)

11. Summary
1. Passwords are insecure and inconvenient
especially on mobile devices
2. Alternative authentication methods are silos
and hence don‘t scale to large scale user
populations
3. The required security level of the
authentication depends on the use
4. Risk engines need information about the
explicit authentication security for good
decision

12. How does FIDO work?
Device

13. How does FIDO UAF work?
… …
SE

14. How does FIDO UAF work?
Can recognize the
user (i.e. user
verification), but
doesn’t have an
identity proof of
the user.
Same Authenticator
as registered before?Same User as
enrolled before?

15. How does FIDO UAF work?
Can recognize the
user (i.e. user
verification), but
doesn’t have an
identity proof of
the user.
Same Authenticator
as registered before?Same User as
enrolled before?
Identity binding to be
done outside FIDO:
This this “John Doe
with customer ID X”.

16. How does FIDO UAF work?
… …
SE
How is the key protected
(TPM, SE, TEE, …)?
What user verification
method is used?

17. Attestation & Metadata
FIDO SERVERFIDO AUTHENTICATOR
Metadata
Signed Attestation Object
Verify using trust anchor
included in Metadata
Understand Authenticator
security characteristic
by looking into Metadata
(and potentially other sources)

18. How does FIDO UAF work?
5. Generate key pair in
Authenticator to protect
against phishing
7. Verify user
before signing
authentication
response
4. Provide
cryptographic proof of
authenticator model
1. Use Metadata to
understand
Authenticator model
security characteristic
2. Define policy
of acceptable
Authenticators
6. Use site-specific
keys in order to
protect privacy
3. Store public keys
on the server
(no secrets)
8. Use channel binding
to protect against
MITM

19. FIDO Building Blocks

20. Registration Overview
FIDO AUTHENTICATOR
FIDO SERVER
FIDO CLIENT
Send Registration Request:
- Policy
- Random Challenge
Start
registration
Verify user
Generate key pair
Sign attestation object:
• Public key
• AAID
• Random Challenge
• Name of relying party
Signed by attestation key
Verify signature
Check AAID against policy
Store public key
AAID = Authenticator Attestation
ID, i.e. model ID

21. Registration Overview (2)
Physical Identity
Virtual Identity
FIDO AUTHENTICATOR FIDO SERVER
WEB Application
{ userid=1234,
jane@mail.com,
known since 03/05/04,
payment history=xx,
…
}
{ userid=1234,
pubkey=0x43246, AAID=x
+pubkey=0xfa4731, AAID=y
}
Registration
AAID y
key for foo.com: 0xfa4731
Relying Party foo.com
Link new
Authenticator to
existing userid
“Know Your Customer” rules
Legacy Authentication

22. UAF Authentication

23. UAF Authentication

24. UAF Authentication

25. UAF Authentication

26. UAF Authentication

27. UAF Authentication

28. UAF Authentication
pat@example.com
Pat Johnson

29. UAF Authentication
Pat Johnson
650 Castro Street
Mountain View, CA 94041
United States
SignedData:
• SignatureAlg
• Hash(FinalChallenge)
• Authenticator random
• Signature Counter
• Signature
FinalChallenge=AppID | FacetID
| channelBinding | challenge

30. UAF Authentication
pat@example.com
Pat Johnson
Payment complete!
Return to the merchant’s web site to
continue shopping
Return to the merchant

31. Transaction Confirmation
SignedData:
• SignatureAlg
• Hash(FinalChallenge)
• Authenticator random
• Signature Counter
• Hash(Transaction Text)
• Signature
FinalChallenge=AppID | FacetID
| channelBinding | challenge

32. FIDO Authenticator
User
Verification /
Presence
Attestation Key
Authentication Key(s)
Injected at
manufacturing,
doesn’t change
Generated at
runtime (on
Registration)
Optional
Components
Transaction
Confirmation
Display
The FIDO Authenticator Concept

33. FIDO Authenticator in SIM Card
SIM Card
Attestation Key
Authentication Key(s)
User Verification
(PIN)
Using Secure Hardware

34. Trusted Execution Environment (TEE)
FIDO Authenticator as Trusted Application (TA)
User Verification / Presence
Attestation Key
Authentication Key(s)
Store at Enrollment
Compare at Authentication
Unlock after comparison
Client Side Biometrics

35. Trusted Execution Environment (TEE)
FIDO Authenticator as Trusted Application (TA)
User Verification
/ Presence
Transaction
Confirmation
Display
Secure Element
Attestation Key
Authentication Key(s)
e.g. GlobalPlatform
Trusted UI
Combining TEE and SE

36. FIDO & Federation
First Mile Second Mile

37. OEM Enabled: Lenovo ThinkPads with
Fingerprint Sensors
OEM Enabled: Samsung Galaxy S5 smartphone & Galaxy Tab S
tablets
Clients available for these operating systems:
Software Authenticator Examples:
Speaker/Face recognition, PIN, QR Code, etc.
Aftermarket Hardware Authenticator Examples:
USB fingerprint scanner, MicroSD Secure Element
FIDO ReadyTM Products Shipping today

38. FIDO is used Today

39. Conclusion
• Different authentication use-cases lead to different
authentication requirements
• Today, we have authentication silos
• FIDO separates user verification from authentication
protocol and hence supports all user verification
methods
• FIDO supports scalable security and convenience
• User verification data is known to Authenticator only
• FIDO complements federation
 Consider developing or piloting FIDO-based
authentication solutions
Dr. Rolf Lindemann, Nok Nok Labs, rolf@noknok.com

40. UAF Registration

41. UAF Registration

42. UAF Registration

43. UAF Registration

44. UAF Registration

45. UAF Registration

46. pat@example.com
Pat Johnson
Link your fingerprint
UAF Registration

47. pat@example.com
Pat Johnson
Link your fingerprint
UAF Registration

48. pat@example.com
Pat Johnson
Link your fingerprint
UAF Registration
Key Registration Data:
• Hash(FinalChallenge)
• AAID
• Public key
• KeyID
• Registration Counter
• Signature Counter
• Signature (attestation key)
FinalChallenge=AppID | FacetID
| channelBinding | challenge

49. pat@example.com
Pat Johnson
UAF Registration