I am a bit unhappy of the development of CTAP2 - the protocol that powers security keys (e.g. Yubikeys).

In the beginning there was U2F (now called CTAP1). You can register, and log in. There already is some complexity, since different transports (BLE, USB, ...)

CTAP2.0 added a PIN or biometrics for additional verification. As it is possible to built authenticators on already existing security hardware (like a TPM), there are a dozens of different attention formats. Credentials can be stored on the authenticator. You can also have symmetric credentials.

CTAP2.1 add another protocol for PIN authentication (only marginally better), and now you may manage your stored credentials (maybe, if the manufacturer imemented it). PIN and biometrics authentication is streamlined, but authenticators need to support both the old and new flow. Enterprises can have a new attestation format, to! Symmetric credentials are secure now.

CTAP2.2 adds JSON encoded messages (optionally), adds more complexity to PIN authentication and support for non-fido credentials.

I think the protocol just got a lot more complex while loosing the focus of what authenticators should do, and do well.

#ctap #Passkeys #webauthn

Does somebody know *why* CTAP2.x ("FIDO2") tokens do not authenticate the key exchange to protect the transmitted PIN from the client device to the authenticor?

Background: When you enter your PIN for a FIDO2 authenticator (e.g. Yubikey), the PIN is encrypted, and only a truncated SHA-256 hash is transmitted. The encryption key is chosen by unauthenticated ephermal ECDH key exchange. As the PINs usually have low entropy, they can be brute forced by an attacker who performs an active MITM attack.

Some smart cards (e.g. the German eID or other Biometric Passports) use PACE nowadays to protect such a key exchange with a PIN or another low-entropy secret (such as the document number) - other password authenticated key exchanges (PAKEs) would certainly be possible as well.

Are active MITM attacks considered to be negligible for the common transports (USB, NFC, Bluetooth) of Webauth? Or are there other reasons why a PAKE is not used?

#ctap #fido #cryptography

browsers should implement a standard webauthn element / input type so that js-free websites could use webauthn too...

#webauthn #browsers #security #fido2 #ctap

Are you still using old, smelly, musty passwords? And then there's the annoying task of typing in numbers/TOTPs all the time? Then FIDO2 might be for you.

In my latest blog post, I explain what FIDO2 is and how it makes passwords and TOTPs obsolete. And it's available for little or no money.

I look forward to hearing your thoughts on this article. Feel free to share it; FIDO2 needs more attention, even from non-technical users!

#fido2 #ctap #webauthn #password #yubi

https://lukasrotermund.de/posts/how-fido2-works-technically

I'm looking for a good overview/comparison of different #MFA/#2FA or #PasswordLess authentication protocols.

The recent #Fido2 #MitM risk made me aware that I need to learn more.

Pointers and #BoostWelcome

#fedipower #wisdomOfTheCrowd #FollowerPower

As the best way to get an answer on the internet, is to state something wrong, let's try this 😜

#FIDO and FIDO2 are actually a whole set of (related?) protocols.
FIDO includes FIDO #UAF (Universal Authentication Framework) and FIDO #U2F (Universal Second Factor).

FIDO2 is the "successor" of FIDO and consists of two parts.
#WebAuthn and #CTAP (Client to Authenticator Protocol). From the name I would guess that WebAuthn is for web stuff (requiring browser support) and CTAP is for IT infrastructure stuff (???)

#Passkey is based on #Fido2
Other related concepts or protocols are #OTP (one-time passwords), #TOTP (Time-based One-time Password) and #HOTP (“H” in HOTP stands for Hash-based Message Authentication Code (HMAC))

Not sure how #SmartCards play into this.

And not sure which of these methods would work for an offline authentication login into your laptop (and ideally also as key for whole disk encryption)

Sad to see how well my research interests speak to each other: content moderation practices and alternative approaches to IP in the Covid-vaccine context! #CTAP #OpenSourceVaccines #Censorship

https://theintercept.com/2023/01/16/twitter-covid-vaccine-pharma/

Our podcast colleagues at “IT-säkerhetspodden” just published a new episode (in English) describing Yubico’s proposed backup solution for WebAuthn, called ARKG.

Interview: https://www.itsakerhetspodden.se/podcast/169-passwordless-med-yubikey/

More info on ARKG: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/

#yubikey #yubico #arkg #webauthn #fido2 #ctap

RT @Winnie_Byanyima@twitter.com: The #PeoplesVaccine Alliance advocates for 3 urgent actions to maximize global vaccine manufacturing:
1) sharing technology & know-how via @WHO@twitter.com's #CTAP
2) #TRIPSwaiver at @WTO@twitter.com
3) investing in enhancing manufacturing capacity in developing countries, especially in Africa.

#PCB48

That's it: #Vaccines must be a legal #commons! Also: the #EU and the #EUCommission had more opportunities 2 support a #commons approach towards drugs/vaccines. Could have pushed 4 #waiver proposed by India/SA or strongly support #CTAP from early on; #IP #Patentetöte
---
RT @fuchschristian
If #EUCommission had demanded that #AstraZeneca does not copyright its vaccine and had insisted that the vaccine must be made a legal commons, the…
https://twitter.com/fuchschristian/status/1355214285547384842

Did #EUCommission really use opportunities 2support a #commons approach towards drugs/vaccines? ->pushing 4 #waiver proposed by India/SA or strongly supporting #CTAP from early on; What abt th other vaccines? Wd U pls point me 2relevant articles re Commissions position&policy?
---
RT @fuchschristian
If #EUCommission had demanded that #AstraZeneca does not copyright its vaccine and had insisted that the vaccine must be made a legal c…
https://twitter.com/fuchschristian/status/1355214285547384842

“The passwordless web explained”

#security #web #passwordless #fido2 #webauthn #ctap

http://nakedsecurity.sophos.com/2018/11/22/the-passwordless-web-explained/

Glad to see #webauthn and #ctap get published...step in the right direction to put authentication in the right place.

https://www.theregister.co.uk/2018/04/11/fido_takes_a_bite_out_of_passwords_with_two_authentication_standards/