WebAuthn: Difference between revisions

Line 25:

* Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.

* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref>. This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits that is inherent to this type of curves and reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.

* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits that is inherent to this type of curves and reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.

Despite these shortcomings the researches still encourage users to continue to use WebAuthn, but came up with some recommendations for potential implementors and developers of the standard and hope that this can be fixed in the upcoming standard, before it is finalized and therefore set in stone. Avoiding such mistakes as early as possible, will prevent the industry from any challenges that are introduced by broken standards and the need for [[Backward_compatibility|backwards compatibility]].

@@ Line 25: / Line 25: @@
 * Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.
-* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref>. This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits that is inherent to this type of curves and reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.
+* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits that is inherent to this type of curves and reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.
 Despite these shortcomings the researches still encourage users to continue to use WebAuthn, but came up with some recommendations for potential implementors and developers of the standard and hope that this can be fixed in the upcoming standard, before it is finalized and therefore set in stone. Avoiding such mistakes as early as possible, will prevent the industry from any challenges that are introduced by broken standards and the need for [[Backward_compatibility|backwards compatibility]].

WebAuthn: Difference between revisions

wikipedia>Karol Babioch