2 ms·
> Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users. You're right. I meant Cloudflare coul
by ignoramous 6y ago
> Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users.
You're right. I meant Cloudflare could ban the generated public-key and not the device's public-key itself. Besides, they could also mark the batch as being taken over by bots and increase the level on challenges issued to the batch. Note though, a single secure module can only generate / store so many public-keys. For instance, Yubi Key 5 supports up to 25 keys, though those could be reset to generate a newer set of 25, but repeat registration of a number of keys from a single batch is bound to trigger some statistical anomalies.
From Cloudflare's blog about Cryptographic attestation of personhood https://archive.is/4EbER https://archive.is/4EbER
> For our challenge, we leverage the WebAuthn registration process. It has been designed to perform multiple authentications, which we do not have a use for. Therefore, we do assign the same constant value to the required username field. It protects users from deanonymization.
Currently, the user-name field is constant for all users. I wanted to point out that that they could amend the registration ceremony to register any user in particular.
- TimWolla 6y ago> For instance, Yubi Key 5 supports up to 25 keys This is for resident keys. A YubiKey 5 supports an infinite number of non-resident WebAuthn keys, because the returned key handle will simply be the private key encrypted with a master key stored on the YubiKey. For authentication the service will send the stored key handle back to the YubiKey which then can decrypt it and use the decrypted private key to sign the challenge.
- deleted 6y ago[deleted]
- ignoramous 6y agoTIL. Envelope encryption. Neat. Can WebAuthn keys be (made) a resident key? If so, is that preferred instead? Conversely, what use case is there for resident keys in context of WebAuthn? For example, if there are multiple master keys, can I switch between them per browser / website (assuming the master key itself is a resident key and not burnt into the element)? Thanks.
- TimWolla 6y agoThe WebAuthn API can register a resident key on the YubiKey. This will basically store the username, private key and domain on the YubiKey. The website then can later request authentication based off a resident key. This will cause your web browser to query the YubiKey for resident keys of the website. You then can select the resident key with the correct username and will be logged in based on strong cryptography without needing to enter your password or username. Depending on your YubiKey configuration you might need to enter your YubiKey pin for this to work. See the screenshot in this comment on a GitHub issue: https://github.com/keepassxreboot/keepassxc/issues/3560#issuecomment-610773697 https://github.com/keepassxreboot/keepassxc/issues/3560#issu... The website will need to support this of course. Also the amount of storage available for resident keys on the YubiKey is limited.