# FIDO2 Facing Kleptographic Threats By-Design
### Lessons from Real Incidents  
So far, the history of security incidents with cryptographic products well reflects the famous saying of [PERSON]: \"Cryptography is typically bypassed, not penetrated\". In Table 1, we recall some famous cases.  
\begin{table}
\begin{tabular}{|p{142.3 pt}|p{142.3 pt}|} \hline
**The Case** & **Description** \\ \hline Crypto AG: intelligence failure & Crypto AG was a Swiss company that produced encryption machines. The company sold equipment to many countries, including Iran, Egypt, and Pakistan. The clients wrongly perceived the company just as a business entity; however, in 1970, the company was sold in secret to the CIA and West-German BND. According to [5], “The use of those devices provided the CIA and the National Security Agency with the ability to decrypt thousands of messages”. \\ \hline A certificate used for the dissemination of Flame & Usage of outdated hash function MD5 in Microsoft’s Terminal Services Licensing infrastructure and acceptance of this function by Microsoft’s operating systems allowed the distribution of flame malware (a member of the Stunard family—see ([6], Section 3.2)). In [7], we read “Flame’s code-signing certificate for this security patch was obtained by fooling a certain part of Microsoft’s PKI into signing a colliding—innovation-looking—sibling certificate using an MD5-based signature algorithm. (..) Even though Microsoft was fully aware of the severe weaknesses of MD5 and spent significant effort on migrating to more secure hash functions for new digital signatures at least since 2008, their software continued to accept (old) MD5-based digital signatures. Unfortunately, the use of MD5-based signatures for licensing purposes in their Terminal Server Licensing Service was overlooked in their efforts”. \\ \hline ROCA [8]: failure of certification frameworks & A cryptographic library deployed on Trusted Platform Modules (TPMs) and Secure Elements (SEs) from Infineon Technologies AG defectively generated RSA keys. More specifically, the keys were formally correct, but the entropy utilized for key generation was substantially reduced. Consequently, the authors of [8] were able to factorize 1024- and 2048-bit moduli. Devices with NIST FIPS 140-2 and CC EAL 5+ certificates were affected. \\ \hline \end{tabular}
\end{table}
Table 1: Examples of failures of processes critical for security.  
Figure 3: FIDO2 authentication.  
The lesson learned is that apart from a scheme being broken by cryptanalysts and the failure of physical protection issues, many things may go wrong. Some of the key points are as follows:  
* Unintentional implementation errors;
* Rogue implementations of good protocols (with trapdoors);
* Failures of a delivery chains;
* Overoptimistic trust assumptions about protocol participants.  
Thus, creating a strong cryptographic scheme with sound security arguments is only the beginning of creating a secure ecosystem. As indicated, for example, in [11], the vendors might be coerced to embed backdoors or hidden espionage tools into their products that could be used against the final users.  
A pragmatic approach to the design of cryptographic protocols is to create them not only having in mind the speculative strength of cryptanalysis (e.g., including the quantum threats), but eliminating trust assumptions for the whole life cycle of a cryptographic product implementing the protocol.