FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

FIDO Alliance Osaka Seminar

1. © FIDO Alliance 2024‹#› Confidential
FIDO Metadata
and Attestation
Rolf Lindemann (Nok Nok)

2. 2 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Passwordless in native apps
Security keys as 2ndfactor in web apps

3. 3 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Passwordless in native apps
Security keys as 2ndfactor in web apps
Keys don’t leave
authenticator

4. 4 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Lookup authenticator
characteristics from
Metadata Service by Model
Keys don’t leave
authenticator
Model can be
attested
Security characteristics
•Certification status
•Key protection
•Fresh/cached user verification
•Attestation root certificate
Passwordless in native apps
Security keys as 2ndfactor in web apps

5. 5 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Passwordless in native apps & web apps
(using security keys or platform authenticators)
Lookup authenticator
characteristics from
Metadata Service by Model
Keys don’t leave
authenticator
Model can be
attested
Security characteristics
•Certification status
•Key protection
•Fresh/cached user verification
•Attestation root certificate

6. 6 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Passwordless in native apps & web apps
Need non-FIDO
method or
security key to
bootstrap new
device
Lookup authenticator
characteristics from
Metadata Service by Model

7. 7 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
FIDO Cross
Device
Authentication
“Phone as Security Key”
Passwordless in native apps & web apps
Lookup authenticator
characteristics from
Metadata Service by Model

8. 8 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Synced
passkeys
Easy device migration
Passwordless in native apps & web apps
Lost or stolen
Import/Export

9. 9 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Passkeys
Easy device migration
Passwordless in native apps & web apps
Lookup authenticator
characteristics from
Metadata Service by Model
User experience aspects
•Authenticator friendly name
•Icon to show to user
Passkey –typically freely exportable

10. 10 © FIDO Alliance 2021
Convenient & phishing resistant 2FA
Synced
passkeys
Easy device migration
Passwordless in native apps & web apps
Lookup authenticator
characteristics from
Metadata Service by ModelSynced passkey –freely exportable
Providerscoped key –cannot leave provider
Device-bound key –cannot leave device
Key Scope
User experience aspects
•Authenticator friendly name
•Icon to show to user
Security characteristics
•Certification status (+FIPS)
•Key protection
•Fresh/cached user verification
•Attestation root certificate
•Key scope
Lost or stolen