FeIDo: Recoverable FIDO2 Tokens Using Electronic IDs (Extended Version)

(2023) FeIDo: Recoverable FIDO2 Tokens Using Electronic IDs (Extended Version).

Text feido-extended-2023.pdf Download (820kB)

Abstract

Two-factor authentication (2FA) mitigates the security risks of passwords as sole authentication factor. FIDO2---the de facto standard for interoperable web authentication---leverages strong, hardware-backed second factors. However, practical challenges hinder wider FIDO2 user adoption for 2FA tokens, such as the extra costs ($20-$30 per token) or the risk of inaccessible accounts upon token loss/theft. To tackle the above challenges, we propose FeIDo, a virtual FIDO2 token that combines the security and interoperability of FIDO2 2FA authentication with the prevalence of existing eIDs (e.g., electronic passports). Our core idea is to derive FIDO2 credentials based on personally-identifying and verifiable attributes---name, date of birth, and place of birth---that we obtain from the user's eID. As these attributes do not change even for refreshed eID documents, the credentials "survive" token loss. Even though FeIDo operates on privacy-critical data, all personal data and resulting FIDO2 credentials stay unlinkable, are never leaked to third parties, and are securely managed in attestable hardware containers (e.g., SGX enclaves). In contrast to existing FIDO2 tokens, FeIDo can also derive and share verifiable meta attributes (anonymous credentials) with web services. These enable verified but pseudonymous user checks, e.g., for age verification (e.g., "is adult").

Item Type:	Monograph (Technical Report)
Divisions:	Christian Rossow (System Security Group, SysSec)
Depositing User:	Fabian Schwarz
Date Deposited:	23 Jan 2023 09:36
Last Modified:	23 Jan 2023 09:36
Primary Research Area:	NRA4: Secure Mobile and Autonomous Systems
URI:	https://publications.cispa.saarland/id/eprint/3894

Actions

Actions (login required)

View Item