# FIDO2 Facing Kleptographic Threats By-Design
## 4 Linking Attacks with Discrete Logarithm Signatures
### Attack 2: Identity Sieve via Rejection Sampling Attack prerequisites:
Of course, for \((u,v)\) encoded in \(V\), the point \(P=f(u)+f(v)\) belongs to the curve used for the signature scheme, but this time, this is true for _any_ bit string \(V\) due to the properties of \(f\). Hence, the auditor cannot detect any deviation from sending a bit string chosen at random. Recall that in Section 5.2, we use this secret agreement framework. #### 8.2.2 RSA Signatures Used for Authentication

If the twisted elliptic curves [44] are used for the ephemeral-ephemeral DH protocol, then an auditor observing malicious participants will be able to see some correlation. Indeed, the server's component will utilize one of the twisted curves, and the infected authenticator _must follow_ the server's choice of the curve--both components will exhibit the same coefficient \(a\in\{0,1\}\) when the trace function is applied on appropriate bit strings (see [44] for details). On the other hand, for truly random choice, the values \(a\) tested by the auditor should be statistically independent on both sides. For the same reason, using a single elliptic curve together with the probabilistic bias removal method would compromise the hidden functionality: both DH components will represent a bit string yielding a point on that particular curve. However, since the signature scheme does not determine the domain parameters used for the kleptographic execution of the DH protocol, the Elligator [40] or the Elligator Squared on the binary curve [41] are the right choices to execute the kleptographic ephemeral-ephemeral DH protocol. ### Indicating the Domain Parameters for Covert Diffie-Hellman

There is a slight technical problem with how to agree upon the parameters for the covert Diffie-Hellman protocol. Obviously, any additional communication is ruled out, while the covert Diffie-Hellman protocol must be executed during registration--the very first contact between the server and an authenticator. Luckily, during the registration procedure, the server indicates a list of preferences regarding the algorithms ([35], Section 5.4). Moreover, \"The sequence is ordered from most preferred to least preferred. The client makes the best effort to create the most preferred credential that it can\". The first algorithm supported by the authenticator on the preferences list might be used for the covert DH protocol. ## 9 Kleptographic Attack on the Server Side

Now, we show that a server can run the WebAuth protocol so that it creates a kleptographic channel to an adversary observing WebAuth messages encrypted by TLS. ### Channel Setup

A malicious server will always negotiate the TLS cipher suite with the key agreement protocol based on the (elliptic curve) Diffie-Hellman protocol and the AEAD encryption mode. All cipher suites used by TLS 1.3 meet this condition. We assume that for each setting of the domain parameters used in the DH protocol and supported by the server, the adversary [PERSON] has left some \"public\" key \(Y\), and only [PERSON] knows the corresponding \(y\) such that \(Y=g^{y}\), where \(g\) is a fixed generator specified by the domain parameters. We assume that the adversary [PERSON] can see the whole encrypted TLS traffic between the client and the server. We assume that the shared secret resulting from the TLS handshake executed by the client and the server is derived by the ephemeral-ephemeral DH protocol. That is, the client chooses a random exponent \(r_{c}\), the server chooses a random exponent \(r_{s}\), and the master shared secret \(s\)\(g^{r_{c}r_{s}}\). (Of course, this key is secure from [PERSON].) For the attack, the server creates a secondary key \(K=\mathsf{KDF}(Y^{r_{s}})\). Note that Adv can calculate \(K\) as \(\mathsf{KDF}((g^{r_{s}})^{y})\) (recall that \(g^{r_{s}}\) is transmitted in clear), while the client would have to break the CDH Problem to derive \(K\). Note that \(K\) is unrelated to the TLS encryption. On the other hand, nothing can prevent Adv and the server from deriving \(K\).