WebAuthn: Difference between revisions
m →API: punctuation |
m →Criticism: minor wording changes |
||
| Line 25: | Line 25: | ||
In August 2018, a team of researchers from Paragon Initiative Enterprises did a security audit of the upcoming WebAuthn standard. While they could not find any specific exploits, they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|accessdate=2018-10-09}}</ref> | In August 2018, a team of researchers from Paragon Initiative Enterprises did a security audit of the upcoming WebAuthn standard. While they could not find any specific exploits, they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|accessdate=2018-10-09}}</ref> | ||
The main points of criticism | The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks: | ||
* Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more. | * Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more. | ||
* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits | * The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past. | ||
The auditors from Paragon Initiative Enterprises also criticized the way in which the standard was initially developed, as the proposal was not made public in advance and experienced cryptographers were not asked for suggestions and feedback. Hence the standard was not subject to broad cryptographic research from the academic world. | The auditors from Paragon Initiative Enterprises also criticized the way in which the standard was initially developed, as the proposal was not made public in advance and experienced cryptographers were not asked for suggestions and feedback. Hence the standard was not subject to broad cryptographic research from the academic world. | ||