# FIDO2 Facing Kleptographic Threats By-Design
### Kleptography  
It is known that cryptographic products might be anamorphic in the sense that they pretend to execute the scheme from their official specification while, in reality, they are running a different one with additional functionalities. Moreover, both products can be _provably_ indistinguishable regarding the official output generated by the products according to the specification.  
The above-mentioned techniques may serve both good and bad purposes. A good one is implementing a signature creation device so that in a case of forgeries (e.g., resulting from breaking the public key), it is possible to fish out the signatures created by the legitimate device [12]. On the other hand, anamorphic methods may be used on the dark side. A prominent example is kleptography (for an overview, see [13]), where an innocent-looking protocol is used for a covert transfer of secret data. Moreover, only a designated receiver can take advantage of the covert channel, while inspecting the code stored in the infected device (including all keys implemented there) does not help to access the covert channel (see Figure 4).  
\begin{table}
\begin{tabular}{|p{142.3 pt}|p{142.3 pt}|} \hline
**The Case** & **Description** \\ \hline Dual-EC: failure of the standardization processes & The paper [9] states, “The surprise for the public cryptographic community was (..) that NSA’s backdooring of Dual EC was part of an organized approach to weakening cryptographic standards. Not mentioned in the reports was the biggest surprise, namely that Dual EC was not dead at all: NIST’s list of “DRBG validations” showed that Dual EC was provided in dozens of commercial cryptographic software libraries. Dual EC was even the default pseudorandom number generator in RSA Security’s BSAFE library”. The Dual-EC contains the classical kleptographic setup. \\ \hline XZ Backdoor: failure of code evaluation procedures & The attack is categorized as a supply-chain attack: the backdoor was committed to the repository of xz-utils package by a person who joined the project two years earlier and had gradually gained trust. The exploit was installed in the liblzma library, which is indirectly used by the OpenSSH and allows remote code execution on infected systems. The backdoor was accidentally detected (see [10] for more details). \\ \hline \end{tabular}
\end{table}
Table 1: _Cont._Unfortunately, kleptography can be hidden in many standard primitives, such as digital signatures [14] or the post-quantum key encapsulation mechanism [15], or even be adopted as a technical standard [16].  
Kleptography takes advantage of a black-box design: to protect the secret keys, a device implementing the protocol must restrict external access to it. So, typically, one can observe only the messages that should be created according to the protocol's official description but cannot see how these messages have been created.  
Entirely eliminating the threat of kleptographic attacks in existing protocols is hard. Some attack methods, like rejection sampling [17], are extremely difficult to combat. What seems to be plausible is to substantially reduce the bandwidth of such channels and eliminate all kleptography-friendly protocol points. This is particularly important in the case of basic components such as user authentication.  
The bad news is that kleptographic setups are possible in authentication protocols. For a few recent examples, see [18; 19; 20].