FIDO authentication is usually not positioned as a means of achieving high assurance Identity proofing but it can be a critical component in best-of-breed remote identity verification. Join this session for a look at how FIDO, Federation and ID Proofing can work together to create a robust identity ecosystem. The solution lays out an architecture for remote identity proofing to create a privacy-preserving credential, using an identity proofing engine based on OpenID Connect, and issuing a FIDO credential used for strong authentication. Featured Speaker: Jerrod Chong, CISSP, VP Solutions, Yubico

1. ©2017Yubico
© 2017 Yubico
FIDO, ID Proofing and
Federation
Jerrod Chong, VP Solutions

2. 2
©2017Yubico
FIDO U2F AKA Security Keys
Global open authentication standard co-created by Yubico & Google
# of ServicesAny Shared SecretsNoOne Authenticator

3. 3
Google Security Key Login
1 2 3
Secure Unphishable / UnMITMable
Simple Insert and press button
Scalable One device, many services
Privacy No Link-ability between services

4. 4
©2017Yubico
4
1st
Government
to offer citizens
opt-in U2F
Secured Digital ID

5. ©2017Yubico
5
Why are we solving this?
● Strong authentication not always tied to identity of user
● FIDO authentication mostly decoupled from ID Proofing
● ID Proofing required for higher assurance levels
● ID Proofing and strong authentication at odds with privacy
● Remote ID Proofing tied to Knowledge Based Verification (KBV)
● Reduce the reliance on weak recovery options

6. ©2017Yubico
“Individuals and organizations utilize secure, efficient, easy‐to‐use
and interoperable identity solutions to access online services in a
manner that promotes confidence, privacy, choice, and innovation.”
-NIST Trusted Identity Group (TIG)
6

7. 7
©2017Yubico
NIST SP 800-63-3
Digital Identity Guidelines 800-63 Revision 3
Highlighting 3 Policy Recommendations
- Decouple Identity assurance from Authenticator assurance
- Deprecate the use of SMS as Out-of-Band verifier
- Approves FIDO U2F for use at highest Authenticator assurance level
(AAL3)

8. ©2017Yubico
8
The Project
Yubico awarded US NIST grant collaborating with various Identity
Providers
● Extend benefits of FIDO U2F to federated identity environments
● Integrate ID Proofing with FIDO U2F authentication
● Share attributes securely, conveniently and privacy-enhancing

9. ©2017Yubico
9
ID verified FIDO Authenticators
U2F Authenticator sent to
the address on ID
Secure access to any
number of services
Mobile ID scanning,
Driver’s license or state ID
● Successful Remote Proofing issues Pre-registered authenticator
● Pre-registration of authenticator ensures authenticity and integrity
(first FIDO credential must be ID verified)

10. ©2017Yubico
10
ID Proofing and Verification (IPV)
2
1
2
3
4
5
68
9
Token Issuance
7
10

11. 11
©2017Yubico
Remote ID Proofing Mobile App

12. 12
©2017Yubico
Token Issuance with
Pre-Registration
IdP

13. 13
U2F
Device Client
Relying
Party
app id, challenge
a; challenge, origin, channel id, etc.
c
a
Check
app id
Generate:
kpub
kpriv
handle h kpub
, h, attestation cert, signature(a,c,kpub
,h)
c, kpub
, h, attestation cert, s
Release
kpub
with
handle h
for user
s
Pre-Registration of Key Handle

14. ©2017Yubico
14
Request access to
Service Provider (SP)
WebsiteUSER
SP
Redirect user to home
institution Identity
Provider (IdP)
SP
Deliver content
to user
SP
Purge user
attribute per
IdP-SP contract
IdP
Prompt user to login +
Send attributes to SP
Attribute
Assertion
IdP data store
Authentication Flow

15. 15
U2F
Device Client
Relying
Party
handle, app id, challenge
h, a; challenge, origin, channel id, etc.
c
a
Check
app id
Lookup
the kpriv
associated
with h
Sign
with kpriv
counter++
counter, signature(a,c, counter)
counter, c, s
Check s
using kpub
Verify origin,
channel id &
counter
s
h
Lookup
the kpub
associated
with h
Authentication

16. ©2017Yubico
16
Identity Ecosystem using Open Standards
● Extend FIDO to services connected via these federation protocols
• U2F Shibboleth (SAML) and OpenID Connect plug-in
• Open source reference implementation
● Build ID Proofing engine using OpenID Connect
• Allows for multiple proofing solutions/providers
• Part of the Identity toolkit

17. ©2017Yubico
● Protecting PII is time and resource intensive
● Difficult to achieve highest identity assurance with Remote ID proofing
● High level of trust required in integrations with third-party vendors
● Compatibility challenges across diverse operating systems and devices
● Additional techniques needed to onboard special needs individuals
17
Lessons Learned

18. 18
©2017Yubico
Questions?

19. ©2017Yubico
© 2017 Yubico
19