WebAuthn: Difference between revisions

Line 141:

The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks:

* Through the mandated use of [[CBOR Object Signing and Encryption|COSE]] ([[RFC:8152|RFC 8152]]) WebAuthn also supports [[RSA (cryptosystem)|RSA]] with [[PKCS 1|PKCS1v1.5 padding]]. This particular scheme of padding is known to be vulnerable to [[Adaptive chosen-ciphertext attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is ~~not~~ considered to be best practice among cryptographers ~~any more~~.

* Through the mandated use of [[CBOR Object Signing and Encryption|COSE]] ([[RFC:8152|RFC 8152]]) WebAuthn also supports [[RSA (cryptosystem)|RSA]] with [[PKCS 1|PKCS1v1.5 padding]]. This particular scheme of padding is known to be vulnerable to [[Adaptive chosen-ciphertext attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is no longer considered to be best practice among cryptographers.

* The FIDO Alliance standardized on the [[public-key cryptography|asymmetric cryptographic]] scheme [[ECDAA]].<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|access-date=2018-10-09}}</ref> This is a version of [[Direct Anonymous Attestation|direct anonymous attestation]] based on [[elliptic curve]]s and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore, the ECDAA standard involves random, non-deterministic signatures, which already has been a problem in the past.

@@ Line 141: / Line 141: @@
 The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks:
-* Through the mandated use of [[CBOR Object Signing and Encryption|COSE]] ([[RFC:8152|RFC&nbsp;8152]]) WebAuthn also supports [[RSA (cryptosystem)|RSA]] with [[PKCS 1|PKCS1v1.5 padding]]. This particular scheme of padding is known to be vulnerable to [[Adaptive chosen-ciphertext attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.
+* Through the mandated use of [[CBOR Object Signing and Encryption|COSE]] ([[RFC:8152|RFC&nbsp;8152]]) WebAuthn also supports [[RSA (cryptosystem)|RSA]] with [[PKCS 1|PKCS1v1.5 padding]]. This particular scheme of padding is known to be vulnerable to [[Adaptive chosen-ciphertext attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is no longer considered to be best practice among cryptographers.
 * The FIDO Alliance standardized on the [[public-key cryptography|asymmetric cryptographic]] scheme [[ECDAA]].<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|access-date=2018-10-09}}</ref> This is a version of [[Direct Anonymous Attestation|direct anonymous attestation]] based on [[elliptic curve]]s and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore, the ECDAA standard involves random, non-deterministic signatures, which already has been a problem in the past.

WebAuthn: Difference between revisions

wikipedia>BovineVulcan