# FIDO2 Facing Kleptographic Threats By-Design
## 4 Linking Attacks with Discrete Logarithm Signatures
### Attack 2: Identity Sieve via Rejection Sampling Attack prerequisites:
Deeper modifications may include the following:

* Replacement of the twisted elliptic curves with the Elligator [40] or with the Elligator Squared on a binary curve [41] (see Section 8 for more details);
* Having switched to one of the methods [40; 41], the ephemeral-static DH protocol utilized in [37; 38] can be replaced with the ephemeral-ephemeral variant of the DH protocol, where the server's ephemeral part is encoded in \(uid\). ### Linking Attack result:

Adv learns \(\mathsf{id}_{U}\) from public key \(\mathsf{pk}\) created by \(\mathsf{Aut}_{U}\) containing a ciphertext decryptable by Adv. **Attack prerequisites:**

We assume that an ephemeral-static version of the DH protocol has already been executed. Hence, the asymmetric key of the Adv is stored by \(\mathsf{Aut}_{U}\). Consequently, in this version of the DH protocol, [PERSON] does not need to be an active participant. It suffices that [PERSON] learns the public RSA keys generated by \(\mathsf{Aut}_{U}\). **Auxiliary techniques:**

**Embedding a ciphertext into a RSA modulus:**: Pessimistically, consider the smallest size of RSA keys allowed in WebAuthn, which is 2048 bits. Then, we may assume that \(\mu\) from line 4 of GetPrimesFast equals \(2048-(8+257)=1783\). We assume that the component \(2t\cdot p_{1}-r\) from (1) will usually change no more than len\(+64=1024+64\) tailing bits of \(n_{c}\). Thus, in the case of \(r_{2}\) calculated in line 5 of GetPrimesFast, we have \(1783-(1024+64)=695\) leading bits unchanged when we add \(2t\cdot p_{1}-r\) to \(n_{c}\). Therefore, the 695 most significant bits of \(r_{2}\) may carry a ciphertext. Note that when the execution path returns to line 5, then it suffices to re-randomize \(r_{1}\), e.g., 128 least significant bits of \(r_{2}\). Consequently, the ciphertext bits of \(r_{2}\) remain unchanged, and enough entropy is still provided. **Diffie-Hellman key exchange:**: Two options are available:

* Ephemeral-static DH: as mentioned above, in this version, the asymmetric key of Adv is stored on \(\mathsf{Aut}_{U}\), but Adv does not have to be an active participant of the FIDO 2 protocol. * Ephemeral-ephemeral DH: if this version is implemented on malicious authenticators, then the cooperating server's ephemeral key shall be transferred in _uid_ (see Section 8 for details). **Algorithm:**

It is a modified version of the attack presented in [37; 38]. \(\mathsf{Auth}_{U}\) generates pk during registration so that it passes \(\mathsf{id}_{U}\) to \(S\) as a ciphertext hidden in pk. This time, the shared secret established using the DH protocol is not used as a seed to generate the prime \(p_{1}\). The factor \(p_{1}\) shall now be generated at random. In this attack, the shared secret is used to derive a key for encrypting a linking identifier. The ciphertext is directly embedded in the generated modulus. ### Impersonation Attack

The previous attack provides more than enough space to leak the identity \(\mathsf{id}_{u}\). On the other hand, the ciphertext space is too small to leak the factorization of an RSA modulus. **Attack result:**

Adv can factor the RSA modulus of pk generated by \(\mathsf{Auth}_{U}\) and derive the corresponding signing key sk. Additionally, the channel for covert ciphertexts used in the RSA modulus is widened, and there are new opportunities for an attack, e.g., a covert transmission of the DRNG seed, or linking information for other keys and services. **Attack prerequisites:**

We assume that \(\mathsf{Auth}_{U}\) and \(\mathsf{Adv}\) share a secret key obtained, for example, by the Diffie-Hellman protocol (see Section 8). **Auxiliary techniques: Embedding two ciphertexts into a RSA modulus**

The channel for encryption will be extended. The first ciphertext is created as in the case of the linking attack. The second ciphertext is available to [PERSON] only after factoring the RSA modulus.