# FIDO2 Facing Kleptographic Threats By-Design
## 4 Linking Attacks with Discrete Logarithm Signatures
### Attack 2: Identity Sieve via Rejection Sampling Attack prerequisites:
## 10 Final Remarks and Conclusions

FIDO2 is an excellent example of a careful and spartan design of an authentication framework that addresses practical deployment issues remarkably well. FIDO2 has significant advantages concerning its simplicity and flexibility on one side and personal data protection on the other side. At first look, it seems that nothing can go wrong during FIDO2 implementation, even if the party deploying the system is malicious: the authenticators are well separated from the network and the server, and their functionalities are severely restricted, leaving little or no room for an attack. To some extent, the client plays the role of a watchdog, controlling the information flow to the authenticator. We show that the initial hopes are false. We have presented a full range of attacks where malicious servers and authenticators use kleptography with severe consequences:

* Dismounting privacy protection by enabling a (third party) adversary to link different public keys generated by an authenticator;
* Enabling the impersonation of the authenticator against a (third party) server. The attacks are kleptographic: there are no detectable changes in the information flow, and the protocol execution appears to be honest. The kleptographic setup is straightforward and concerns quite minimal changes in protocol execution. The real threat is a false sense of security: security audits and certification may be waived or can be superficial and fail to detect kleptographic trapdoors. The threats may propagate: a designer of a sensitive service may falsely assume that the protection given by FIDO2 is tight, while the attacker may be able to clone the authenticator remotely. Final Note

This paper does not provide any link to a prototype implementation of the attacks. This is intentional: we do not want to facilitate any misuse of the information contained in this paper. The extent of the information provided is limited to what an auditor should look for in the inspected system components as potentially malicious code. Conceptualization, M.K. and P.K. ; Methodology, M.K. and M.Z. ; Software, P.K. ; Validation, M.K., A.L.-D. and P.K. ; Formal analysis, M.K. and P.K. ; Investigation, A.L.-D., P.K. and M.Z. ; Writing--original draft, M.K., A.L.-D., P.K. and M.Z. ; Writing--review & editing, M.K. and P.K. ; Supervision, M.K. ; Project administration, M.K. and P.K. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The original contributions presented in the study are included in the article, further inquiries can be directed to the corresponding authors. The authors declare no conflicts of interest. The following abbreviations are used in this manuscript:

CCCommon Criteria [47]

CSACybersecurity Act [4]

CTAPClientTo Authenticator Protocol

DRNGDeterministicRandom Number Generator

EDIWEuropean Digital Identity Wallet

eIDASElectronic Identification, Authentication, and Trust Services; see [2]

ENISAEuropean Union Agency for Network and Information Security

FIDOFast Identity Online

GDPR(EU)General Data Protection Regulation [3]

## References

* 1. The European Parliament and the Council of the European Union. Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 Amending Regulation (EU) No 910/2014 as Regards Establishing the European Digital Identity Framework. 2024. Available online: [[https://eur-lex.europa.eu/eli/reg/2024/1183/oj](https://eur-lex.europa.eu/eli/reg/2024/1183/oj)]([https://eur-lex.europa.eu/eli/reg/2024/1183/oj](https://eur-lex.europa.eu/eli/reg/2024/1183/oj)) (accessed on 22 October 2024). * 2. The European Parliament and the Council of the European Union. Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC. _Off. J. Eur. Union_**2014**, 257, 73-114.