FIDO Enablement Workshop: How to FIDO-enable web applications using FIDO protocol
23
StrongAuth, Inc. Proprietary 1 Version 1 – October 2015 FIDO-enabling a web-application using Universal 2 nd Factor (U2F) Arshad Noor CTO, StrongAuth, Inc.
-
Upload
fido-alliance -
Category
Technology
-
view
186 -
download
3
Transcript of FIDO Enablement Workshop: How to FIDO-enable web applications using FIDO protocol
StrongAuth, Inc. Proprietary 1Version 1 – October 2015
FIDO-enablinga web-application using
Universal 2nd Factor (U2F)
Arshad NoorCTO, StrongAuth, Inc.
StrongAuth, Inc. Proprietary 2Version 1 – October 2015
Agenda
● Introduction
● Business Issues
● Operational Issues
● Technical Issues
● Security Issues
● Enablement Process
● Questions
StrongAuth, Inc. Proprietary 3Version 1 – October 2015
Introduction
● Founded in July 2001
● Silicon Valley-based, privately-held
● Open-source cryptographic solutions company– Public Key Infrastructure (PKI)
– Symmetric Key Management System (SKMS)
– Strong-Authentication
– FIDO Alliance member with open-source server
● Customers on 6 continents in:– Finance, Healthcare, e-Commerce, Medical Devices,
Pharmaceutical, Entertainment, Manufacturing, ....
StrongAuth, Inc. Proprietary 4Version 1 – October 2015
Business Issues
● Multiple authentication schemes
● Account Recovery
● FIDO Authenticator acquisition/support
● Which applications to FIDO-enable first?
● Protocol decision
StrongAuth, Inc. Proprietary 5Version 1 – October 2015
Multiple Auth. Schemes
● UserID/Password
● LDAP/AD
● Biometric
● OTP
● 2-Step Verification
● Smartcard
● ..... and now FIDO
StrongAuth, Inc. Proprietary 6Version 1 – October 2015
Account Recovery
● Forgotten/Lost/Stolen FIDO Authenticators– Policy
● Internal vs. External customers● What security policy applies to them?● What applications must be accessible to them?● What is the intersection?
– Recovery Process● Internal customers● External customers
StrongAuth, Inc. Proprietary 7Version 1 – October 2015
Authenticator Acquisition
● FIDO CertifiedTM or “Go your own way”
● Should you standardize on one?
● A small set?
● All?
● Who pays for the Token?
● Support for “unsupported” FIDO CertifiedTM Tokens– Users are going to end up with multiple Tokens sooner
or later
StrongAuth, Inc. Proprietary 8Version 1 – October 2015
Which applications to enable first?
● Web-applications– Mission-critical vs. Nice-to-have
– What authentication does it support currently?
– Desired user experience?● FIDO with Password● FIDO with CAPTCHA (Password-less)● FIDO with Token Authentication (Password-less)
● Chrome 43 or greater
● Firefox...
StrongAuth, Inc. Proprietary 9Version 1 – October 2015
FIDO with Password
StrongAuth, Inc. Proprietary 10Version 1 – October 2015
FIDO + CAPTCHA (Password-less)
StrongAuth, Inc. Proprietary 11Version 1 – October 2015
FIDO U2F Password-less
StrongAuth, Inc. Proprietary 12Version 1 – October 2015
Protocol Decision
● Universal 2nd Factor (U2F)
● Universal Authentication Framework (UAF)
● FIDO 2.0
StrongAuth, Inc. Proprietary 13Version 1 – October 2015
Operational Issues
● Availability
● Scalability
● Security
StrongAuth, Inc. Proprietary 14Version 1 – October 2015
Availability
PrimaryData Center
TertiaryData Center
SecondaryData Center
StrongAuth, Inc. Proprietary 15Version 1 – October 2015
Scalability - 1
App 1
DC #2
FIDOCluster #2
DC #1
FIDOCluster #1
App 2
DC #2
FIDOCluster #4
DC #1
FIDOCluster #3
App 3
App 4
DC #2
FIDOCluster #N
DC #1
FIDOCluster #N
App 5
App N
StrongAuth, Inc. Proprietary 16Version 1 – October 2015
Scalability - 2
App 1
DC #2
FIDOCluster #2
DC #1
FIDOCluster #1
App 2
App 3
App 4
App 5
App N
StrongAuth, Inc. Proprietary 17Version 1 – October 2015
Technical Issues
● Web-application framework– More than 90; Java (24), PHP (26), ...
● JavaScript
● Chrome dependency
● USB-port access
StrongAuth, Inc. Proprietary 18Version 1 – October 2015
Security
● What's the issue? Aren't FIDO protocols supposed to be secure?– Yes, but.....
● If KeyHandle includes a private-key, security of Key-Encrypting-Key matters
● Attestation Certificate' private-key protection always matters
● “Substitution of Keys” Attack
StrongAuth, Inc. Proprietary 19Version 1 – October 2015
Security – SuKs - 1
Jill
Jack
ID User .... Key Handle Public Key
1234 Jack .... CAFEBEEF FEDCBA
1357 Jill .... CAFEBABE ABCDEF
... .... .... .... ....
StrongAuth, Inc. Proprietary 20Version 1 – October 2015
Security – SuKs - 2
Jill
Jack
ID User .... Key Handle Public Key
1234 Jack .... CAFEBEEF FEDCBA
1357 Jill .... CAFEBEEF FEDCBA
... .... .... .... ....
StrongAuth, Inc. Proprietary 21Version 1 – October 2015
Enablement Process
● Pick a web-application – any application
● Pick an Account Recovery mechanism
● Pick a few FIDO U2F Authenticators
● Pick a FIDO U2F Server – any server ;-)
● Get their FIDO-enablement Tutorial
● Modify the web-application
● Test, test, test,......
● Plan for productionalization
● That's all, folks!
StrongAuth, Inc. Proprietary 22Version 1 – October 2015
Our Design
LDAP
1 Connect 2 1FA
4 Escrow key
5 Encrypt & store file
5 Encrypt &store file
3 2FA (FIDO)
Note: Secure cloud-storage is a standard feature of CryptoEngine, and may be used to store encrypted documents in the cloud if desired. However, cryptographic keys are never stored in the cloud.
Strong-Authentication
On-premises infrastructure
StrongAuth, Inc. Proprietary 23Version 1 – October 2015
Questions?
● Contact information– (408) 331-2000
– www.strongauth.com
