1. U2F Case Study Examining the U2F paradox 3 What is Universal 2 nd Factor (U2F)?
U2F Authentication Tokens - Cryptsoft · FIDO compliant second factor authentication token U2F...
2
01010101100100101101001101110010101011010101010 [email protected] WWW.CRYPTSOFT.COM +61 7 3103 0321 | US +1 650 918 4362 All trademarks, service marks, trade names, product names and logos are property of their respecve owners. FIDO compliant second factor authencaon token U2F Authencaon Tokens Cryptsoſt and Feian have collaborated to deliver a Fast IDenty Online (FIDO) Universal Second Factor (U2F) authencaon token that is supported by Cryptsoſt’s OASIS Key Management Interoperability Protocol (KMIP) products. Cryptsoſt’s U2F token meets the market demand for stronger privacy, security, and increased ease of use while avoiding the difficules of using mulple usernames and passwords. Feian’s FIDO compliant authencaon token brings the benefits of lower costs, stronger security, interoperability, and open standards, while also avoiding vendor lock-in and proprietary technology costs. Key Features Second Factor Experience (U2F standards) • One-Device-For-All One device secures mulple services, including services from Google, Yubico and Cryptsoſt • Privacy Service specific encrypon keys No keys shared among service providers • Security No phishing or man-in-the-middle aacks • Easy to Use Just register once Press one buon each me to authencate No addional drivers or soſtware required • Wide Compability Works on Windows, Linux, OSX Universally idenfied as a USB HID device • FIDO Alliance Compliant hp://www.fidoalliance.org AUTHENTICATION Login and Password Online Authorisaon Request Local Device Authencaon Success Insert U2F Token, Press buon Authencated 1 2 3 website Authencated
Transcript of U2F Authentication Tokens - Cryptsoft · FIDO compliant second factor authentication token U2F...
101010101100100101101001101110010101011010101010
sales [email protected] WWW.CRYPTSOFT.COM+61 7 3103 0321 | US +1 650 918 4362
All trademarks, service marks, trade names, product names and logos are property of their respective owners.
FIDO compliant second factor authentication tokenU2F Authentication Tokens
Cryptsoft and Feitian have collaborated to deliver a Fast IDentity Online (FIDO) Universal Second Factor (U2F) authentication token that is supported by Cryptsoft’s OASIS Key Management Interoperability Protocol (KMIP) products.
Cryptsoft’s U2F token meets the market demand for stronger privacy, security, and increased ease of use while avoiding the difficulties of using multiple usernames and passwords.
Feitian’s FIDO compliant authentication token brings the benefits of lower costs, stronger security, interoperability, and open standards, while also avoiding vendor lock-in and proprietary technology costs.
Key Features
Second Factor Experience (U2F standards)
• One-Device-For-All One device secures multiple services,
including services from Google, Yubico and Cryptsoft
• Privacy Service specific encryption keys No keys shared among service providers • Security No phishing or man-in-the-middle attacks • Easy to Use Just register once Press one button each time to authenticate No additional drivers or software required • Wide Compatibility Works on Windows, Linux, OSX Universally identified as a USB HID device • FIDO Alliance Compliant http://www.fidoalliance.org
AUTH
ENTI
CATI
ON
Login and Password
Online Authorisation Request Local Device Authentication Success
Insert U2F Token, Press button Authenticated
1 2 3
website Authenticated
101010101100100101101001101110010101011010101010
sales [email protected] WWW.CRYPTSOFT.COM+61 7 3103 0321 | US +1 650 918 4362
@CRYPTSOFT CRYPTSOFT-SECURITY-SPECIALISTS@CRYPTSOFT
FIDO compliant second factor authentication tokenU2F Authentication Tokens
Why is FIDO Different?
• User is prompted to choose an available FIDO authenticator that matches the online service’s acceptance policy.
• User unlocks the FIDO authenticator using a fingerprint reader, a button on a second–factor device, securely–entered PIN or other method.
• User’s device creates a new public/private key pair unique for the local device, online service and user’s account.
• Public key is sent to the online service and associated with the user’s account. The private key and any information about the local authentication method (such as biometric measurements or templates) never leave the local device.
• Online service challenges the user to login with a previously registered device that matches the service’s acceptance policy.
• User unlocks the FIDO authenticator using the same method as at Registration time.
• Device uses the user’s account identifier provided by the service to select the correct key and sign the service’s challenge.
• Client device sends the signed challenge back to the service, which verifies it with the stored public key and logs in the user.
• The FIDO U2F protocol uses standard public key cryptography techniques to provide
stronger authentication. • During registration with an online service, the user’s
client device creates a new key pair. It retains the private key and registers the public key with the online service.
• Authentication is done by the client device proving possession of the private key to the service by signing a challenge.
• The client’s private keys can be used only after they are unlocked locally on the device by the user.
• The local unlock is accomplished by a user–friendly and secure action such as swiping a finger, entering a PIN, speaking into a microphone, inserting a second–factor device or pressing a button.
• The FIDO protocols are designed from the ground up to protect user privacy.
• The protocols do not provide information that can be used by different online services to collaborate and track a user across the services.
Terence Rex Bryson
Lynn John D Sue
Jill Trevor Sally
websiteEnter User
Enter Password
Bank.com
********
website.com
registration
+
Terence Rex Bryson
Lynn John D Sue
Jill Trevor Sally
websiteEnter User
Enter Password
Bank.com
********
website.com
SMS codes OTP devices
U2F Registration
U2F Login
1
1
2
2
4
4
3
3
