# FIDO2 Facing Kleptographic Threats By-Design
## 4 Linking Attacks with Discrete Logarithm Signatures
### Attack 2: Identity Sieve via Rejection Sampling Attack prerequisites:
The attack may enable \(\mathsf{Adv}\) to derive all secret keys generated by \(\mathsf{Auth}_{U}\). However, it is easy to reduce the leakage to, say, the secret key used to authenticate with a single server \(S\). In this case, the key derivation procedure may be altered: instead of \(K\), we use \(K_{S}=\mathsf{Hash}(K,id_{S})\). Consequently, the leaked information will be \(K_{S}\) instead of \(K\). ### Modified Linking Attacks

In many cases, the impersonation attacks are variants of the linking attacks. Then, we refer to the linking attacks and describe only the necessary modifications. #### 5.1.1 Modifications of Attacks 1 and 3

In Attack 1 from Section 4.1 and Attack 3 from Section 4.3, we replace \(C(\mathsf{id}_{U})\) by \(C(K)\). Note that now, the adversary may stop collecting bits much earlier. Namely, \(\mathsf{Adv}\) can guess some number of missing bits (say 30), recalculate the seed as, say, \(K^{\prime}\), derive a secret key \(\mathsf{sk}^{\prime}\) from \(K^{\prime}\), and finally check whether it matches the public key \(\mathsf{pk}\) used by the authenticator. On the other hand, the seed is presumably longer than the identifier \(\mathsf{id}_{U}\). #### 5.1.2 Modifications of Attacks 5 and 6

One can modify the attack from Section 4.5. The difference is that instead of calculating \(\mathsf{sk}_{2}\leftarrow\mathsf{sk}_{1}+z\), the authenticator sets \(\mathsf{sk}_{2}=z\). In the case of the modification of Attack 5, \(\mathsf{sk}_{1}\) may be used in some \"master\" service server under the control of the adversary. This way, secret keys to all other servers may be derived by \(\mathsf{Adv}\). Alternatively, \(\mathsf{Auth}_{U}\) may leak keys to only selected services. In the case of the modification of Attack 6, \(\mathsf{Auth}_{U}\) may determine when to leak the secret key devoted to a given service. ### Scenario 2--Dynamic Kleptographic Setup

In this attack, there is no preinstalled kleptographic key on a device; all necessary key material is installed in a covert way, and the key material is retrieved from the seemingly regular FIDO2 execution. #### Attack result:

This is an impersonation attack, where \(\mathsf{Adv}\) learns the seed used by \(\mathsf{Auth}_{U}\) for random number generation; hence, \(\mathsf{Adv}\) can recalculate all the private keys generated by \(\mathsf{Auth}_{U}\) after the attack. Moreover, if \(\mathsf{Adv}\) has access to the signatures created after the attack, then in the case of standard signatures based on the discrete logarithm problem, we can reconstruct private ephemeral values, and thus the signature private keys, even if the private keys were established before the attack. #### Attack prerequisites:

* \(\mathsf{Auth}_{U}\) colludes with a malicious server \(S\). * For some reason, the user \(U\) holding \(\mathsf{Auth}_{U}\) is forced to register with \(S\) (e.g., \(S\) is the server used by the citizens to fill out a tax return form), or \(S\) is a very popular commercial service used by a large part of the population. * The implementation of \(\mathsf{Auth}_{U}\) supports domain parameters that the server \(S\) selects during the attack; on the other hand, the server chooses the domain parameters supported by the malicious implementation of the authenticators. #### Auxiliary techniques

**Ephemeral-ephemeral Diffie-Hellman key exchange:**: this is to be described in Section 8.2. **Notation:**: In FIDO2, all the allowed signature schemes based on the discrete logarithm problem utilize elliptic curves ([33], Section 3.7). To illustrate the attack, we assume that a prime order elliptic curve is used (e.g., the case of ECDSA signatures). **Algorithm:**: The first stage of the attack is when \(\mathsf{Aut}_{U}\) registers with server \(S\). First, \(S\) selects \(uid\) in a specific way, but \(uid\) is still random. Second, \(\mathsf{Aut}_{U}\) adjusts its DRNG based on \(uid\) (Algorithm 11).