WebAuthn: Difference between revisions

Line 26:

The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks:

* Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.

* The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.

@@ Line 26: / Line 26: @@
 The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks:
-* Support for [[RSA_(cryptosystem)|RSA]] with [[PKCS_1|PKCS1v1.5 padding]] is required by the WebAuthn standard. This particular scheme of padding is known to be vulnerable to [[Adaptive_chosen-ciphertext_attack|specific attacks]] for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.
 * The FIDO alliance standardized on an [[Public-key_cryptography|asymmetric cryptographic]] scheme called ECDAA.<ref name="ecdaa-spec">{{cite web|url=https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html|title=FIDO ECDAA Algorithm|publisher=FIDO Alliance|date=2018-02-27|accessdate=2018-10-09}}</ref> This is a version of [[Direct_Anonymous_Attestation|direct anonymous attestation]] based on [[Elliptic_curve|elliptic curves]] and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [[Elliptic-curve_cryptography|elliptic curve cryptography]], as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore the ECDAA standard involves random, non-deterministic, signatures, which already has been a problem in the past.

WebAuthn: Difference between revisions

5.148.11.92 (talk)