Open AccessJournal Article
On Making U2F Protocol Leakage-Resilient via Re-keying.
TLDR
This work presents a countermeasure for the SCA based on re-keying technique to prevent the repeated use of the device secret key for encryption and signing and recommends a modification in the existing U2F protocol to minimise the effect of signing with the fixed attestation private key.Abstract:
The Universal 2nd Factor (U2F) protocol is an open authentication standard to strengthen the two-factor authentication process. It augments the existing password based infrastructure by using a specialized USB, termed as the U2F authenticator, as the 2nd factor. The U2F authenticator is assigned two fixed keys at the time of manufacture, namely the device secret key and the attestation private key. These secret keys are later used by the U2F authenticator during the Registration phase to encrypt and digitally sign data that will help in proper validation of the user and the web server. However, the use of fixed keys for the above processing leaks information through side channel about both the secrets. In this work we show why the U2F protocol is not secure against side channel attacks (SCA). We then present a countermeasure for the SCA based on re-keying technique to prevent the repeated use of the device secret key for encryption and signing. We also recommend a modification in the existing U2F protocol to minimise the effect of signing with the fixed attestation private key. Incorporating our proposed countermeasure and recommended modification, we then present a new variant of the U2F protocol that has improved security guarantees. We also briefly explain how the side channel attacks on the U2F protocol and the corresponding proposed countermeasures are similarly applicable to Universal Authentication Framework (UAF) protocol.read more
Citations
More filters
Posted ContentDOI
How many FIDO protocols are needed? Surveying the design, security and market perspectives.
TL;DR: In this article, the authors trace the evolution of FIDO protocols by identifying the technical characteristics and security requirements throughout the different versions while providing a comprehensive study on the different markets (e.g., digital banking, social networks, e-government, etc.), applicability, ease of use, extensibility and future security considerations.
Proceedings ArticleDOI
A Formal Analysis of the FIDO UAF Protocol.
TL;DR: This paper presents a comprehensive and formal verification of the FIDO UAF protocol by formalizing its security assumptions and goals and modeling the protocol under different scenarios in ProVerif and identifies the minimal security assumptions required for each of the security goals of FIDo UAF to hold.
Patent
Systems and methods for cryptographic authentication of contactless cards
Kaitlin Newman,Kimberly Haynes,Charles Nathan Crank,Andrew Cogswell,Colin Hart,Jeffrey Rule,Lara Mossler,Latika Gulati,Abdelkader M'Hamed Benkreira,Cunningham Sarah J,Sophie Bermudez,Michael Mossoba,Wayne Lutz +12 more
TL;DR: In this article, the authors provide an example of systems and methods for data transmission system between transmitting and receiving devices, where each transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device.
Dissertation
Design and analysis of password-based authentication systems
TL;DR: This thesis is devoted to the secure design of password hashing algorithm and the analysis of existing password-based authentication systems and provides a cryptographic module based approach for password hashing.
Journal ArticleDOI
A Forward-secure Efficient Two-factor Authentication Protocol
Steven J. Murdoch,Aydin Abadi +1 more
TL;DR: This work presents a 2FA protocol that requires a client to remember only a single secret value/PIN, does not involve any modular exponentiations, and is in a standard model and imposes up to 40% lower communication overhead than the state-of theart solutions do.
References
More filters
Book ChapterDOI
Differential Power Analysis
TL;DR: In this paper, the authors examine specific methods for analyzing power consumption measurements to find secret keys from tamper resistant devices. And they also discuss approaches for building cryptosystems that can operate securely in existing hardware that leaks information.
Book
Cryptography and Network Security: Principles and Practice
TL;DR: The new edition of William Stallings' Cryptography and Network Security: Principles and Practice, 5e is a practical survey of cryptography and network security with unmatched support for instructors and students.
Proceedings ArticleDOI
Encrypted key exchange: password-based protocols secure against dictionary attacks
TL;DR: A combination of asymmetric (public-key) and symmetric (secret- key) cryptography that allow two parties sharing a common password to exchange confidential and authenticated information over an insecure network is introduced.
Book
Cryiptography and Network Security : Principles and Practices, 3rd ed
TL;DR: In this article, the authors present a survey of the most popular methods for teaching creativity in the field of cryptography and apply them in the context of public-key cryptography and RSA.