4 ms·

- The administrator can enforce use of hardware-backed keys [1] - U2F Tokens cost $8-$25 and are significantly cheaper than full-blown Yubikeys - U2F Tokens d

by HHad3 7y ago

- The administrator can enforce use of hardware-backed keys [1] - U2F Tokens cost $8-$25 and are significantly cheaper than full-blown Yubikeys - U2F Tokens do not have a key limit, which enables using a unique public key per server for privacy/anonymity [1] https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f#L92 https://github.com/openssh/openssh-portable/blob/master/PROT...

eeZah7Ux 7y ago
Importantly, there are fully open source implementations of U2F hardware tokens. On top of that, U2F tokens have no memory. This makes them more durable and make the chipset even smaller.
- sowbug 7y ago
  They do have a device counter, incremented on every usage, to help detect cloning. It's up to the server whether to enforce the constraint that the counter increase on every usage. Unfortunately this means that the token does need a little bit of memory. I don't know whether FIDO2 has the same design.
  - zaarn 7y ago
    FIDO2 has, it's an expansion of u2f to allow for more and wider use cases.
mtgx 7y ago
I predict some Chinese companies will soon start to offer very cheap or free U2F keys to western companies as a "bonus" for other deals they may have. Free U2F keys! What could possibly go wrong?
harshreality 7y ago
> U2F Tokens do not have a key limit They must have some limit. EC Keys are roughly 32 (256 bit) or 48 (384 bit) bytes (x2 to store the public half, right?), and most of these devices don't have MB of storage afaik... I think they have security chips with like 64-256kb of secure storage. So once you get into the range of thousands of sites, wouldn't you run out of room? ETA: thanks akerl, I didn't realize that's what they (or most of them) were doing; I didn't even realize deterministically generating an EC key from a seed was efficient enough to do it quickly on a tiny embedded chip.
- akerl_ 7y ago
  In theory, yes. In practice, the way that most U2F tokens (for example, Yubikeys) work is to storage a single device-specific secret key on the token, which never changes. Then, when “adding” a key for a site, they take the provided details from the server as inputs, along with the secret key, to derive a new, site-specific private key, which is used for U2F. That allows them to “store” an unlimited number of site keys. Note that this method isn’t mandated by the U2F spec, so it’s not guaranteed that any key which implements U2F will do so in this way. The OpenSSH protocol doc alludes to this requirement when they talk about why U2F needed a custom method for interfacing with SSH: the site’s handle needs to be provided as input to the key, so that it can re-derive the site-specific private key, and that communication channel didn’t already exist in ssh-agent.
  - tialaramex 7y ago
    Critically this isn't quite correct. The handle (IIRC the FIDO spec calls it a cookie but that doesn't matter) is NOT chosen by the relying party (in this case a SSH server you're logging into). It's chosen by the token itself during the enrollment process and given to the relying party with the other results of enrollment to be stored. The token will use local random data in addition to random data supplied by the relying party for choosing a private key (and thus in the design you describe, the handle). This is a common design choice in cryptographic systems because it means if either Alice OR Bob really used random numbers the results are truly random, things only go badly if both parties defect. In WebAuthn this means if you use your token to enroll with Google, and Facebook, and say Twitter, so long as the people who built the token did a good job it won't matter if both Google and Facebook are trying to betray you and deliberately didn't use random data, they can't attack your Twitter account this way. Edit: refer to the device as a "token" not a key for clarity
    - akerl_ 7y ago
      I feel like a much simpler correction might have been “you meant application ID instead of key handle”, given that the application ID is based on the individual server (it’s generally partly the URL and a server-provided challenge), and is combined with the token secret key to create the full handle. Nothing in my comment implied that if google betrayed you, it would leak your facebook token.
Leace 7y ago
> - The administrator can enforce use of hardware-backed keys [1] This is also available on PKCS/OpenPGP for some tokens (and not only for auth keys). See: https://developers.yubico.com/PIV/Introduction/PIV_attestation.html https://developers.yubico.com/PIV/Introduction/PIV_attestati... and https://developers.yubico.com/PGP/Attestation.html https://developers.yubico.com/PGP/Attestation.html

by HHad3 7y ago

eeZah7Ux 7y ago

Importantly, there are fully open source implementations of U2F hardware tokens. On top of that, U2F tokens have no memory. This makes them more durable and make the chipset even smaller.

sowbug 7y ago
They do have a device counter, incremented on every usage, to help detect cloning. It's up to the server whether to enforce the constraint that the counter increase on every usage. Unfortunately this means that the token does need a little bit of memory. I don't know whether FIDO2 has the same design.
- zaarn 7y ago
  FIDO2 has, it's an expansion of u2f to allow for more and wider use cases.

mtgx 7y ago

I predict some Chinese companies will soon start to offer very cheap or free U2F keys to western companies as a "bonus" for other deals they may have. Free U2F keys! What could possibly go wrong?

harshreality 7y ago

> U2F Tokens do not have a key limit They must have some limit. EC Keys are roughly 32 (256 bit) or 48 (384 bit) bytes (x2 to store the public half, right?), and most of these devices don't have MB of storage afaik... I think they have security chips with like 64-256kb of secure storage. So once you get into the range of thousands of sites, wouldn't you run out of room? ETA: thanks akerl, I didn't realize that's what they (or most of them) were doing; I didn't even realize deterministically generating an EC key from a seed was efficient enough to do it quickly on a tiny embedded chip.

akerl_ 7y ago
In theory, yes. In practice, the way that most U2F tokens (for example, Yubikeys) work is to storage a single device-specific secret key on the token, which never changes. Then, when “adding” a key for a site, they take the provided details from the server as inputs, along with the secret key, to derive a new, site-specific private key, which is used for U2F. That allows them to “store” an unlimited number of site keys. Note that this method isn’t mandated by the U2F spec, so it’s not guaranteed that any key which implements U2F will do so in this way. The OpenSSH protocol doc alludes to this requirement when they talk about why U2F needed a custom method for interfacing with SSH: the site’s handle needs to be provided as input to the key, so that it can re-derive the site-specific private key, and that communication channel didn’t already exist in ssh-agent.
- tialaramex 7y ago
  Critically this isn't quite correct. The handle (IIRC the FIDO spec calls it a cookie but that doesn't matter) is NOT chosen by the relying party (in this case a SSH server you're logging into). It's chosen by the token itself during the enrollment process and given to the relying party with the other results of enrollment to be stored. The token will use local random data in addition to random data supplied by the relying party for choosing a private key (and thus in the design you describe, the handle). This is a common design choice in cryptographic systems because it means if either Alice OR Bob really used random numbers the results are truly random, things only go badly if both parties defect. In WebAuthn this means if you use your token to enroll with Google, and Facebook, and say Twitter, so long as the people who built the token did a good job it won't matter if both Google and Facebook are trying to betray you and deliberately didn't use random data, they can't attack your Twitter account this way. Edit: refer to the device as a "token" not a key for clarity
  - akerl_ 7y ago
    I feel like a much simpler correction might have been “you meant application ID instead of key handle”, given that the application ID is based on the individual server (it’s generally partly the URL and a server-provided challenge), and is combined with the token secret key to create the full handle. Nothing in my comment implied that if google betrayed you, it would leak your facebook token.

Leace 7y ago

> - The administrator can enforce use of hardware-backed keys [1] This is also available on PKCS/OpenPGP for some tokens (and not only for auth keys). See: https://developers.yubico.com/PIV/Introduction/PIV_attestation.html https://developers.yubico.com/PIV/Introduction/PIV_attestati... and https://developers.yubico.com/PGP/Attestation.html https://developers.yubico.com/PGP/Attestation.html