Breaking FIDO

© 2016 Yubico

Are Exploits in There?

FIDO U2F (Universal 2nd Factor)© 2016 Yubico●●●●Analyzing FIDO U2F
Attack and Countermeasures
Implementation Considerations
Resources2

User Experience© 2016 Yubico

1. Enter username/pwd

2. Insert U2F device

3. Touch U2F device

3Core Features & Supporting Sites● Scalable- Works across any number of services- Remote provisioning● Secure- Protects against phishing & MitM
- Verifies user presence© 2016 Yubico● Simple UX- Single gesture operation● Open Standard- Native platform/browser support4Challenge Parameter (c)Client Data = Challenge, Origin, Channel ID© 2016 Yubicoc = SHA-256 hash (Client Data)

5

Registration
U2F Device

ClientServer
AppID, challenge

VerifyAppID

AppID, client data

© 2016 Yubico

Generate:
private key
public key
key handle

public key, key handle, signature

Construct client
data containing
challenge, origin,channel ID

pk, kh, sig, client data
Verifyclient data
Verify sig
Store pk,kh
6

Authentication
U2F Device

ClientServerAppID, challenge, key handle
VerifyAppID© 2016 Yubico

Retrieveprivate key
Verify AppIDSign client
data
counter ++AppID, client data, key handle

counter, signature

Construct client
data containing
challenge, origin,channel ID

Fetchpublic key,key handle
for usercounter, signature, client data
Verifyclient data
Verify sig
7

Replay sessions

acme.com
Attacker
Reuse credentials© 2016 Yubico

Password DB stolen

not_protected.com

Attacker8

Password Reuse & Replay Attack
U2F
DeviceRelying
Party

Clientchallenge

challenge

Lookupkpub

Signwith kpriv

signature(challenge)© 2016 Yubicoss
Checksignature (s)using kpub
9

Attacker siteacm3.com

acme.com© 2016 Yubico

Phishing (pwd,OTP, SMS, Push)

Attacker
10

Attacker site
acm3.comacme.com© 2016 Yubico

Phishing

Proof of user presence

Attacker11

Phishing Protection
U2F
DeviceRelying
Party

Clientchallenge

challenge, origin, channel id© 2016 Yubico

Retrieveprivate key
Verify AppID
Sign client
dataLookup
kpubc
signature(c)sc, sCheck susing kpub
Verify origin &channel id

12

1MitM(fake/stolen cert, BEAST)
2

acme.comsteal assertion4

use cookie© 2016 Yubico

3

Proof of user presence

Attacker
13Hijack User Login Session
U2F Device

ClientServer

AppID, challenge, key handle
VerifyAppID

AppID, client data, key handle© 2016 Yubico

Retrieveprivate key
Verify AppID
Sign client
data

signature

Construct client
data containing
challenge, origin,channel ID

Fetchpublic key,
key handle
for usersignature, client data

steal cookie

Verifyclient data
Verify sig
14

Channel ID (Token Binding)TLS© 2016 Yubico

Bind Token with Token Binding ID

Token Binding(Private Key)

Token Binding ID: Hash<Public Key>

acme.com
Token Binding(Public Key)
15

TokenBindingacme.com server© 2016 Yubico

Steal assertion

Proof of user presence

No assertion orcookie reuse

Attacker16

MitM Protection
U2F
DeviceRelying
PartyClient
challenge

challenge, origin, channel id
Verify AppID
Sign client
datac
signature(c)s© 2016 Yubico

Lookupkpubc, s
Check susing kpub
Verify origin &channel id17

“I promise a user was here”“The server challenge was: KSDJsdASc8-A17pW”“The origin was: accounts.acme.com”“The TLS connection state was: 3454567”© 2016 Yubico

Sincerely, your Browser●Origin mismatch for key handle => MitM attack!

●

Incorrect origin name => MitM attack!

●Channel ID mismatch => MitM attack!
18

MalwareAttacker© 2016 Yubicoacme.com server

19Compromised ClientU2F Device

ClientServerAppID, challenge, key handle
VerifyAppID

AppID, client data, key handle© 2016 Yubico

Retrieveprivate key
Verify AppID
Sign client
data

signature

Construct client
data containing
challenge, origin,channel IDFetch
public key,
key handle
for usersignature, client data
Verifyclient data
Verify sig
20Extract/Export
Private KeyAttacker© 2016 Yubicoacme.com server
Proof of user presenceWhat are the Alternatives?
● Smart card => Scaling● OTP/SMS => Phishing© 2016 Yubico● Push notification => Phishing

Google’s research paper on FIDO U2F deployment: yubico.com/google-study

22Implementation Considerations© 2016 Yubico● Registration flow
- TOFU (Trust On First Use)
- Attacker enables FIDO on account first- User sets up weak backup options● Recovery flow
- Lowering the level of assurance- Lost/stolen authenticator/device- Onboarding credentials to new devices
23

How to Get Started?
Learn
Read the specifications dev.yubi.co/U2F & github.com/dainnilsson/u2f-tutorial
Go through a MiniTwit U2F tutorial MiniTwit training video

Implement
Google reference code github.com/google/u2f-ref-code
Build your own U2F server dev.yubi.co/U2F/libraries
Use Yubico standalone U2F server dev.yubi.co/u2fval© 2016 Yubico

TestYubico U2F demo server demo.yubico.com/u2f
Google U2F demo server u2fdemo.appspot.com
24Thank you!

© 2016 Yubico

Questions