Downloaded 23 times
Uploaded byFIDO Alliance
Introduction to the FIDO Alliance: Vision & Status
This document summarizes the FIDO Alliance's vision and status. It discusses how authentication has become a major problem and how over 250 organizations are working together through the FIDO Alliance to solve this problem by developing open standards for simpler and stronger authentication using public key cryptography. The FIDO Alliance aims to deliver security, privacy, interoperability and usability through specifications such as FIDO UAF, FIDO U2F and the upcoming FIDO2/WebAuthn specifications. The Alliance has seen strong growth in functional certifications and aims to also offer security and biometric certifications to validate authenticator safety and accurate user identification.
More Related Content
Similar to Introduction to the FIDO Alliance: Vision & Status
More from FIDO Alliance
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
Introduction to the FIDO Alliance: Vision & Status
- 1. All Rights Reserved| FIDO Alliance | Copyright 20181 FIDO ALLIANCE: VISION AND STATUS BRETT MCDOWELL EXECUTIVE DIRECTOR
- 2. All Rights Reserved| FIDO Alliance | Copyright 20182 AUTHENTICATION IS OUR BIGGEST PROBLEM
- 3. All Rights Reserved| FIDO Alliance | Copyright 20183 >250 ORGANIZATIONS SOLVING THE PROBLEM TOGETHER + SPONSOR MEMBERS + ASSOCIATE MEMBERS + LIAISON MEMBERS
- 4. All Rights Reserved| FIDO Alliance | Copyright 20184 FIDO SCOPE Physical-to-digital identity User Management Authentication Federation Single Sign-On Passwords Risk-BasedStrong MODERN AUTHENTICATION
- 5. All Rights Reserved| FIDO Alliance | Copyright 20185 THE MISSION: SIMPLER & STRONGER AUTHENTICATION SECURITY USABILITY Poor Easy WeakStrong =authentication open standards for simpler, stronger authentication using public key cryptography
- 6. All Rights Reserved| FIDO Alliance | Copyright 20186 WHAT HAS ACTUALLY CHANGED Device’s “Authenticator” User verification FIDO Authentication Require user gesture before private key can be used Challenge (Signed) Response Private key dedicated to one app Public key
- 7. All Rights Reserved| FIDO Alliance | Copyright 20187 HOW INDUSTRY ENABLES THIS CHANGE Device’s “Authenticator” User verification FIDO Authentication … …SE
- 8. All Rights Reserved| FIDO Alliance | Copyright 20188 ATTESTATION + METADATA Private attestation key Signed Attestation Object Metadata Understand Authenticator security characteristic by looking into Metadata from mds.fidoalliance.org FIDO Registration Verify using trust anchor included in Metadata
- 9. All Rights Reserved| FIDO Alliance | Copyright 20189 FIDO DELIVERS ON KEY PRIORITIES Security Privacy Interoperability Usability
- 10. FIDO Specifications FIDO UAF FIDOU2F (FIDO) CTAP* (FIDO) WebAuthn* (FIDO+W3C) All Rights Reserved | FIDO Alliance | Copyright 201810 *FIDO2: In Development
- 11. All Rights Reserved| FIDO Alliance | Copyright 201811 COMING SOON: FIDO2 • FIDO2 Project • W3C Web Authn specification based on FIDO web APIs • Client-to-Authenticator Protocol(CTAP) • Expanded certification program to accommodate growing ecosystem • Key role for platforms • Enables Native Browser + Platform Support • Firefox, Chrome, Edge, Opera etc. • Significantly broadens addressable market reach for FIDO authentication GOAL: Ubiquitous FIDO authentication FIDO 1.x: Strong ecosystem growth FIDO 2 Project: Native browser + platform support
- 12. All Rights Reserved| FIDO Alliance | Copyright 201812 FIDO CROSS-PLATFORM SUPPORT via 3rd-party development
- 13. All Rights Reserved| FIDO Alliance | Copyright 201813 SAMPLE: FIDO-ENABLED SERVICES 3.5 BILLION+ AVAILABLE TO PROTECT ACCOUNTS WORLDWIDE
- 14. All Rights Reserved| FIDO Alliance | Copyright 201814 STATUS: FUNCTIONAL CERTIFICATIONS 32 62 74 108 162 216 253 304 343 363 383 425 Apr-15 Jul-15 Sep-15 Dec-15 Mar-16 May-16 Aug-16 Dec-16 May-17 Jul-17 Oct-17 Jan-18
- 15. First of itskind program to empirically validate biometrics through third-party labs and assure that they correctly identify users regardless of biometric modality on all FIDO implementation types All Rights Reserved | FIDO Alliance | Copyright 201815 Assure that authenticator secrets are safe on all FIDO implementation types based on third-party laboratory verification of FIDO security requirements in coordination with existing security programs SECURITY CERTIFICATION BIOMETRIC CERTIFICATION COMING SOON: SECURITY + BIOMETRIC CERTIFICATIONS
- 16. All Rights Reserved| FIDO Alliance | Copyright 201816 THANK YOU BRETT MCDOWELL BRETT@FIDOALLIANCE.ORG
Editor's Notes
- #4 History of the Alliance: Organization was organized in 2012, open to any organization to join in 2013 with the mission to solve the world’s password problem FIDO was launched with just 6 member companies. Today we have more than 250 members from around the world Very focused mission – develop authentication standards so there’s a new way for users to authenticate to online services that does not share the inherent vulnerabilities of passwords. This includes the security AND usability. Over the past 10-20 years we’ve learned that adding steps to the authentication process is a crucial factor in adoption — it has to be a better experience or deployers will see low opt-in rates. We wanted to make sure that this new, better security was also a better user experience. The FIDO Alliance also develops training and certification programs to ensure true interoperability
- #7 We use private keys generated and maintained by the authenticator to sign server generated challenges. The server uses the public key from the registered authenticator to verify the signature. Each private key is dedicated to a single relying party. So we only store public keys on the server-no user private keys. So hacking the server is less attractive to hackers.
- #8 With this concept of the Authenticator, we get two dimensions of scalability. Scalability in terms of Authenticator implementation. We can leverage TPMs, embedded Secure Elements, SIM Cards and Trusted Execution Environments (TEE in short) to implement the Authenticator. And Scalability in terms of user verification methods. The Authenticator can support passcodes to verify the user or face recognition, or speaker recognition, Iris, fingerprint and even method not invented yet. We also can combine various user verification methods, e.g. fingerprint with an alternative PIN. And this is done in most existing implementations.
- #11 Put “coming 2017” for CTAP, W3C and UVC
- #15 How are these deployments going live and where are the devices coming from? This chart shows adoption of devices and commercially available software.