# FIDO2 Facing Kleptographic Threats By-Design
## 4 Linking Attacks with Discrete Logarithm Signatures
### Attack 2: Identity Sieve via Rejection Sampling Attack prerequisites:
### Attack 6: Correlated Secret Keys with a Trigger Signature

In this attack, \(\mathsf{Auth}_{U}\) will be able to convince [PERSON] that the public key \(\mathsf{pk}\) used for authentication with a server \(S\) was created by an authenticator of user \(U\). Moreover, the proof will be released at a time freely chosen by \(\mathsf{Auth}_{U}\) and hidden in the FIDO2 execution. **Attack prerequisites:**

* There is a key pair \((\mathsf{sk}_{U},\mathsf{pk}_{U})\) associated with user \(U\), where \(\mathsf{sk}_{U}\) is stored in \(\mathsf{Auth}_{U}\), while \(\mathsf{pk}_{U}\) is known to \(\mathsf{Adv}\). * \(\mathsf{Auth}_{U}\) holds the \"public\" kleptographic key \(Y\) of the attacker. * \(\mathsf{Adv}\) knows \(y\) such that \(Y=g^{y}\). * \(\mathsf{Auth}_{U}\) can store a random parameter \(k\) for future use. * \(\mathsf{Adv}\) has access to the signatures created by \(\mathsf{Auth}_{U}\) in the interaction with server \(S\). **Attack result:**

At a freely chosen time, \(\mathsf{Auth}_{U}\) enables \(\mathsf{Adv}\) to detect that a public key \(\mathsf{pk}=g^{\mathsf{sk}}\) used in some service \(S\) belongs to \(U\), or more precisely, to an authenticator that holds the master secret key \(\mathsf{sk}_{U}\) of user \(U\). The key \(\mathsf{sk}\) is not exposed to \(\mathsf{Adv}\). **Algorithm:**

At the moment of registration with a server \(S\), the procedure of generating the key pair \((\mathsf{sk},\mathsf{pk})\) on the side of \(\mathsf{Auth}_{U}\) is modified in the following way (Algorithm 9):

```
Input: shared secret \(K_{U}\), identifier \(id_{S}\) of server \(S\) Procedure\(\mathsf{KeyGen}(K_{U},id_{S})\)  choose \(k_{S}\) at random \(z\leftarrow\mathsf{Hash}(Y^{k_{S}})\) \(\mathsf{sk}\leftarrow\mathsf{sk}_{U}+z\pmod{\text{group order}}\) \(\mathsf{pk}\gets g^{\mathsf{sk}}\) returnpk,sk,store \((k_{S},id_{S})\) for the future use
```

**Algorithm 9** Modified key generation during registration with \(S\). At the moment when the link between \(U\) and \(\mathsf{pk}\) has to be revealed to \(\mathsf{Adv}\), \(\mathsf{Auth}_{U}\) executes FIDO2 with server \(S\) in a slightly modified way. Namely, during the signature creation process, instead of choosing \(k\) at random, \(\mathsf{Auth}_{U}\) takes \(k=k_{S}\), where \((k_{S},id_{S})\) has been stored during registration with \(S\) (Algorithm 9). Adv inspects the signatures delivered to \(S\) (Algorithm 10). The above attack can be modified slightly, making it even more harmful. Namely, the element \(g^{k}\) triggering the test may originate from a signature presented to a server \(S^{\prime}\
eq S\). Mounting such an attack could be easier since the alternative server \(S^{\prime}\) may be fully controlled by \(\mathsf{Adv}\), while for some reason, user \(U\) may be forced to authenticate with \(S^{\prime}\) (e.g., \(S^{\prime}\) might be a popular online shopping platform). **5. Impersonation Attacks**

The general strategy of the attacks is to enable the adversary to seize the private key used to authenticate. There are two main attack scenarios:

* Scenario 1: The adversary \(\mathsf{Adv}\) transmits a message \(M\) to \(\mathsf{Auth}\) in a covert channel within an innocent-looking FIDO2 execution. Then, \(\mathsf{Auth}\) deviates from the protocol specification and, on the basis of \(M\), calculates key \(K\) and then uses \(K\) as a seed for anDRNG and derives the secret keys \(\mathsf{sk}\) for server \(S\) from DRNG\((K,id_{S})\), where \(id_{S}\) is the identifier of \(S\). As \(\mathsf{Adv}\) holds \(K\), the secret keys of \(\mathsf{Auth}\) can be calculated by \(\mathsf{Adv}\). * Scenario 2: the hidden information flow is reversed: \(\mathsf{Auth}\) transmits a covert message \(M\) to \(\mathsf{Adv}\) hidden in a FIDO2 execution. Using \(M\), \(\mathsf{Adv}\) derives the secret key \(\mathsf{sk}\) used by the authenticator. The way in which the key \(K\) or \(\mathsf{sk}\) is calculated/derived from \(M\) is asymmetric, and based on the Diffie-Hellman protocol.