Deploying FIDO Authentication: Technical Considerations

All Rights Reserved | FIDO Alliance | Copyright 20181
Deploying FIDO
Authentication:
Technical Considerations

Authentication
Server
Device
User
https://paypal.com

FIDO BUILDING BLOCKS
RP
SERVER
RELYING PARTY
APPLICATION
SERVER
BROWSER
PLATFORM
AUTHENTICATOR
1. Server
accepts or rejects login
2. Authenticator
gets user permission;
creates registration / authn requests
3. Browser / Platform
provides API for accessing authnr
4. Relying Party Application (RP App)
mobile / web app that uses FIDO APIs for
authentication
5. RP server
web / REST server that uses FIDO server for
Authentication
1
4
3
2
5

Application Integration

Relying Party Application
Welcome Tour Feedback
Transfer Money
Home
Point of Sale
Register Login About
Profile
Statements Invoices Tools

Apps: Two Points of Integration
Register Login

Flavors of Register
First Factor (Passwordless) Second Factor (Token)

App Integration - Register
BROWSER
AUTHENTICATOR
Register (
Account,
RelyingPartyID
);Brett
https://paypal.com
RegisterResponse {
Credential,
Attestation
}; Public Key
Attestation
User
Verification

Flavors of Login
First Factor (Passwordless) Second Factor (Token)

App Integration - Log In
BROWSER
AUTHENTICATOR
Sign (
Challenge,
RelyingPartyID
);
SignResponse {
Signature
};
Brett
Challenge
Signature
https://paypal.com
User
Verification

Server Integration

Messages Sent to Server
RP
SERVER
RELYING PARTY
APPLICATION
SERVER
BROWSER
PLATFORM
AUTHENTICATOR
1. Relying Party Application
Takes message from API…
2. Message
…and sends message to…
3. Relying Party Server
…which processes the message
with help from…
4. FIDO Server
1
4
32

Server Registration
RegisterResponse {
Credential,
Attestation
};
Public Key
Attestation
User Data Store
Brett:
Public Key
Registered!
1.Create New User
2.Validate Attestation
(optional)
3.Store Public Key

Attestation, Metadata, MDS
• What is attestation?
Signed statement from authenticator that the
metadata is accurate
• What is metadata?
Information about an authenticator that helps
establish trust
• Who needs it?
Relying parties: decide what authenticators
they trust
Social Networks: maybe not so important…?
Financial Institutions: might be required by
regulators...?
MetaData
Service
(MDS)

Server Authentication
SignResponse {
Signature
};
Signature
User Data Store
1.Lookup User
2.Verify Challenge
3.Verify Signature
w/ Public Key
Brett:
Challenge
Public Key
Authenticated!

Introducing FIDO2

RELYING PARTY APPLICATION
Browser “Application”:
A normal website - HTML, CSS, JavaScript

FIDO2: WEBAUTHN
A new JavaScript API
that enables FIDO Authentication
in the browser
Supported In:

EXTERNAL
AUTHENTICATOR
19
FIDO2: CLIENT-TO-AUTHENTICATOR PROTOCOL (CTAP)
RELYING PARTY
APPLICATION
BROWSER
PLATFORM
INTERNAL
AUTHENTICATOR
CTAP
authenticatorMakeCredential()
authenticatorGetAssertion()

FIDO2: EXTENSIONS
• User Verification Caching (UVC)
(see previous slide)
• Location Extension
provides GPS position information as part of the authentication
• Transaction Authorization
prompts a user to approve a specific transaction amount (e.g. – transfer $100?)
• User Verification Method (UVM)
how many factors (have / know / are) were used in the authentication, and what kinds of factors (fingerprint,
voice, etc.)
• User Verification Index (UVI)
uniquely identifies which data record was used to identify a user (e.g. – which finger, for fingerprint biometrics)
• Authenticator Selection
allows a Relying Party to guide the selection of the authenticator that will be leveraged when creating the
credential
• FIDO AppID
allows Relying Parties who have previously registered a credential using the legacy FIDO JavaScript APIs to
request an assertion

A (Quick) Tour of APIs

U2F JavaScript API
https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-javascript-api-v1.1-id-20160915.html#high-level-
javascript-api

UAF Android APIs
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-client-api-transport-v1.0-ps-
20141208.html#android-intent-api

UAF iOS API
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-client-api-transport-v1.0-ps-20141208.html#ios-
custom-url-api

UAF Browser API
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-client-api-transport-v1.0-ps-20141208.html#dom-api

UAF Operation Messages
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-
uaf-protocol-v1.0-ps-20141208.html#authentication-request-
message
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-prot
v1.0-ps-20141208.html#registration-request-message

UAF Server Processing
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-protocol-
v1.0-ps-20141208.html#registration-processing-rules
https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-protocol-
v1.0-ps-20141208.html#authentication-response-processing-rules-for-fido-
server

WebAuthn / FIDO 2.0 API
https://w3c.github.io/webauthn/#api

WebAuthn Server Processing
https://w3c.github.io/webauthn/#rp-operations

Thanks!
Adam Powers
Technical Director
adam@fidoalliance.org

Deploying FIDO Authentication: Technical Considerations

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Deploying FIDO Authentication: Technical Considerations

Similar to Deploying FIDO Authentication: Technical Considerations (20)

More from FIDO Alliance

More from FIDO Alliance (20)

Recently uploaded

Recently uploaded (20)

Deploying FIDO Authentication: Technical Considerations