WebAuthn: Difference between revisions
edit primary citation |
Undid revision 878926258 by 5.148.11.92 (talk): It is not an dubios claim, but explained in detail in the advisory from Paragon, e.g. it states "As a consequence of its COSE legacy, WebAuthn specifically requires ongoing support for RSA with PKCS1v1.5 padding. Much has been written about the past twenty years of padding oracle and signature forgery vulnerabilities inherent to PKCS1v1.5 padding." |
||
| Line 26: | Line 26: | ||
The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks: | The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks: | ||
* Through the mandated use of COSE (RFC 8152) WebAuthn also supports [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]]. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more. | |||
* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past. | * The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past. | ||