7 ms·
U2F/UAF/Webauthn are a really interesting chicken/egg problem. Right now, not too many providers support these auth protocols, even though they are more secure
by jwcrux 9y ago
U2F/UAF/Webauthn are a really interesting chicken/egg problem.
Right now, not too many providers support these auth protocols, even though they are more secure than current 2fa alternatives and provide a better user experience. The aren't widely supported because that costs development time and many of their customers don't have security keys.
Customers won't buy security keys because it's an added cost that isn't supported by many websites.
The author of the post briefly mentions SoftU2F at the bottom of the post, but it's important to recognize how significant SoftU2F is to the U2F ecosystem.
We're just now starting to see consumer hardware come with HSM's built in. Apple SEP, Intel SGX, etc. are examples of this. SoftU2F _will_ be able to leverage these consumer HSM's to do secure crypto operations - see the pull request at [0] about storing keys in the SEP. This will effectively put U2F and UAF capability into the hands of your average consumer with no additional cost. Things can be just _built-in_, which is what it'll take to start seeing increased protocol adoption across browsers and service providers.
I'm stoked about the future of security keys and the associated protocols. Both external keys and HSM's built directly into consumer hardware.
[0] https://github.com/github/SoftU2F/pull/29 https://github.com/github/SoftU2F/pull/29
- weeks 9y agoWhile I absolutely agree with you, it seems far more likely that native implementations by Apple, Google and Microsoft will dominate the market. Windows Hello is a great early example of this.
- ptoomey3 9y agoSoftU2F was designed fully conscious of this. It was largely developed to help push forward the idea of a software based token with every hope that, over time, native browser and operating system implementations push things fully into the mainstream.
- jwcrux 9y agoI hope they do. Wouldn't that be incredible? Having _native_ U2F/UAF built right into the browser. The hard part is that there's another more subtle chicken and egg problem when it comes to software implementations and consumer HSM. Google/Apple/Microsoft will likely only really push forward native implementations when there is enough market share for consumer hardware having HSM's built in to make it worth it with feasible fallback options.
- jlgaddis 9y agoIt's too bad that TPM usage never really took off. TPMs would have (in theory) been great for this use case that U2F is addressing.
- mjg59 9y agoNot entirely, since there's no easy way to tie physical presence to secret availability
- jimktrains2 9y agoWhat happens when I need to log in on a new device?
- iancarroll 9y ago> We're just now starting to see consumer hardware come with HSM's built in. I'm not very familiar with how TPMs work but don't they already give you this? TPMs are on most computers already, except for Apple-branded ones.
- hdhzy 9y agoTPMs are more complex. They can be used as a virtual smart card. TPM can be used to store client certificate used in HTTPS. U2F on the other hand is super simple by design. For example Yubikey uses one symmetric secret to generate P-256 keys deterministically. That means they don't need to store actual asymmetric keys, they can derive them from secret on demand.
- jimktrains2 9y agoWhat does it use to generate the key? The secret and the URL/realm? I guess it's implicit that you won't ever need to regenerate one key without regenerating others?
- hdhzy 9y agoOrigin is used to create "key handle" that is given to the service and need to be used during login. See Yubico documentation for details: https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener...
- hdhzy 9y agoUnfortunately solutions based on SGX lose two advantages of hardware tokens: no physical touch button and no portability. SGX doesn't provide any real advantage. For example Chrome team was evaluating storing Token Binding keys in SGX but eventually ended in using software store due to their (quite reasonable) threat model.