FIDO Masterclass

© FIDO Alliance 2021
FIDO Masterclass
Andrew Shikiar
Executive Director & Chief Marketing Officer
David Turner
Director of Standards Development

Orgs suffered a successful
phishing attack in 2020
(RiskBased Security)
57%
18 million
COVID-19 themed malware and phishing emails
blocked per day by Google
$18.5 million
Average cost of cyberattack in financial
services, higher than any other vertical
(Accenture)
Increase in cyberattacks against
financial services between February
and April 2020
(VMWare)
238%
Orgs breached as a result of a
user password compromise
(MobileIron)
42%
Verified accounts that tweeted in
Bitcoin scam after social
engineering attack on Twitter
45
Number of times more likely the
financial services sector is to be hit
by a cyberattack
(Boston Consulting Group)
300x
2
Execs who say their digital transformation
plans have sped up due to COVID-19
(Trulioo)
97%

SMS and OTPs add security,
but are inconvenient and still phishable
Passwords are not fit for purpose
• Clumsy
• Hard to remember
• Easy to phish, harvest, replay
3

Industry imperative: Simpler and stronger
Security
Usability
Poor Easy
Weak
Strong
=
Single Gesture
Possession-based Authentication
Open standards for simpler,
stronger authentication using
public key cryptography
4

2013
The FIDO Alliance was launched
5
Simpler,
IDentity Online
Fast
Stronger Authentication

Backed by global tech leaders
7
+ Sponsor members + Associate members + Liaison members + Government members

How Does FIDO
Authentication Work?

FIDO Authentication: How it works
User verification
Require user gesture before
private key can be used
Authenticator
FIDO
Authentication
Private key dedicated
to one app
Public key

c,kpub,clientData,ac,tbs, s
accountInfo, challenge, [cOpts]
c,kpub,clientData,ac,cdh,rpId,cntr,AAGUID[,exts],
signature(tbs)
s
FIDO Registration
rpId, ai, hash(clientData), cryptoP, [exts]
verify user
generate:
key kpub
key kpriv
credential c
store:
key kpub
c
Authenticator
select Authenticator according to cOpts;
determine rpId, get tlsData;
clientData := {challenge, origin, rpId, hAlg, tlsData}
cOpts: crypto params, credential black list,
extensions
cdh
ai
tbs
ac: attestation certificate chain

clientData, cntr, exts, s
FIDO Authentication
Authenticator Relying Party
rpId, [c,] hash(clientData)
select Authenticator according to policy;
check rpId, get tlsData (i.e. channel id, etc.);
lookup key handle h;
clientData := {challenge, rpId, tlsData}
clientData,cntr,[exts],signature(cdh,cntr,exts)
s
cdh
challenge, [aOpts]
verify user
find
key kpriv
cntr++;
process exts
lookup kpub
from DB
check:
exts +
signature
using
key kpub

Attestation + Metadata
Private
attestation key
Signed Attestation Object
Metadata
Understand Authenticator
security characteristic by looking
into Metadata from
mds.fidoalliance.org
FIDO Registration
Verify using trust anchor
included in Metadata

In summary: Simpler
Reduces reliance on
complex passwords
Single gesture
to log on
Same authentication
on multiple devices
Works with commonly
used devices
Fast and
convenient

In summary: Stronger
Based on public
key cryptography
No server-side
shared secrets
Keys stay
on device
No 3rd party in
the protocol
Biometrics, if used,
never leave device
No link-ability between
services or accounts

Certification makes ecosystem tick
Functional Certification (End-to-End):
▸ Conformance Testing
▸ Interoperability Testing
▸ Universal Server
Security Certification Levels
▸ How well do you protect the private key?
▸ 3rd-party laboratory verification
▸ Complemented by Biometric Component certification
Biometric Certification Program
▸ Empirically validate biometrics through third-party labs
▸ Assure that they correctly identify users regardless of
biometric modality on all FIDO implementation types

FIDO Progress: Becoming
Part of the Web’s DNA

How to become part of the Web’s DNA
Industry collaboration & standardization
Shipping in devices & platforms at massive scale
Strong regulatory and government embrace
18

2021
Devices Support
FIDO
4 Billion+
FIDO Certified
Products
800+
People are using
passwordless methods
each month*
150 million
*Microsof
t
19

Now supported cross-platform
Hello
21

22
Supported by growing number of service providers

23
Growing trend of government recognition of FIDO

FIDO is becoming part of the Web’s DNA
Industry collaboration & standardization
Shipping in devices & platforms at massive scale
Strong regulatory and government embrace
24

Cross platform
login in action
25

Filling the Gaps:
Adjacent Work in
Identity & IoT
28

Identity Verification and Binding

FIDO Authentication has been
proven to protect against account takeover through phishing
and other trial-based attacks.
But…
“What happens if
I lose my
FIDO authenticator?”
Why FIDO and ID Verification?
For accounts protected
with FIDO Authentication, the account
recovery process when a FIDO device
is lost or stolen becomes critical to
maintaining the integrity of the user’s
account.

Market gaps – and a need to fill them
FIDO promotes remote identity proofing through possession. Possessed item
could be gov’t ID, device, etc.
However, no criteria exist for determining what’s “good enough” for verifying
possessed element used during remote identity proofing
Relying parties are left to their own devices to establish acceptance criteria
and performing “bake-offs” across different vendors
• This testing is time-consuming and expensive
• Testing typically isn’t representative of real-world fraud vectors

DocAuth performance criteria status*
• Document security features define levels of
sophistication
• Attack vectors and key threats defined
• Performance metrics such as false
acceptance / rejection rates help
• Relying Parties navigate market solutions
• Verification algorithms and end-to-end user
journey both tested
• Geographic flexibility
*Under review

Face verification criteria in development
• Establishing certification criteria
around
1. Selfie match to photo on ID document
2. Liveness detection
• Incorporate into test program
• Critical steps to match document to
live applicants
• Borrows heavily from existing
biometric certification program

Binding topics under discussion
• How do we tie the identity
proofing event to the FIDO
authenticator?
• How do we prevent an attacker
from hijacking a proofing event?
• What metadata should be
carried with the binding?
?

Priorities & milestones
Starting now
Work underway
Define acceptance
criteria for identity
document verification
Engage FIDO
Accredited Lab for
volunteer PoC for
testing program
Define acceptance
criteria for live face
verification
Binding verification
results to FIDO
authenticators
Launch certification
program based on
these criteria

IoT: FIDO Device Onboard (FDO)

How long does it take
to manually onboard1 10,000
Gateways, Devices, Sensors?
Answer:
Over 2-man years2

Aligning FIDO IOT to Use Case and Ecosystem
CSP & On-prem
Support
IoT Platform
ISV Suite
Silicon/device
Ecosystem
SI Ready Connectivity
Support
Use cases where FIDO IOT delivers maximum value
• Industrial and Enterprise devices:
thermometers, sensors, actuators, controls, lighting, medical, etc.
• Multi-ecosystem applications and services:
not tied to specific cloud framework
• Distributor sales:
deliver from stock, specify binding info after sale to customer
• Device resale / redeploy:
reset to factory conditions repeat onboarding process with new credentials

Fast, Scalable Device Provisioning,
Onboarding & Activation
39
Drop ship device to
installation location
Power-up & connect
to Network
Auto-provisions, Onboards
to Cloud
BENEFITS1
• Zero touch onboarding – integrates readily with existing zero touch solutions
• Fast & more secure1 – ~1 minute
• Hardware flexibility – any hardware (from ARM MCU to Intel® Xeon® processors)
• Any cloud – internet & on-premise
• Late binding - of device to cloud greatly reduces number of SKUs vs. other zero touch offerings
• Open - LF-Edge SDO project up and running, code now on GitHub
39
1. No product or component can be absolutely secure

40
Provisioning with FDO
Device Manufacturer Device Recipient
2
3
Load Ownership
Voucher at
Procurement
Device
6
1011
Build and Ship FDO
IOT
Enabled Devices
1
Register Ownership
to Target Platform
2
Register Device to
Rendezvous Service
3
Devices use FDO to
find owner location
4 Devices
Authenticated and
Provisioned
5
Devices send sensor
data to IoT Platform
6
5
Late Binding
Provisioning
1
Single SKU –
Multiple Target clouds
Registration
Discovery 4
Target Cloud
(Device Management
System) with integrated
FDO Owner
Rendezvou
s
service
IOT Device power on
10
01
01
11
00
10
01
01
11
00
10
01
01
11
00
Cloud Managed,
IoT data flows
Ownership
Voucher
Device manufacture – supply chain Device deployed
Device power on

Summing Up:
Moving to a Passwordless Future
(or a less passwords future)

What Needs to Happen:
Replace password logins with Biometrics or Keys
No knowledge-based authentication for ID proofing
Replace passwords with FIDO keypairs
42

The Future of User Authentication
FIDO Authentication is the industry’s answer to the password problem
INDUSTRY BACKED
FIDO represents the
efforts of the world’s
largest companies
IN MARKET
Leading service
providers are using
FIDO today
FITS ALL USE CASES
Native app and web
support allows
scalable deployments
SUPPORTED
Built-in support on
leading browsers and
platforms
STRONGER
Phishing resistance
prevents account
takeover
FASTER
Reduces sign in times
and increases login
success rates
PRIVATE
Credentials and
biometrics never leave
device
CONVENIENT
Leverages technologies
built into everyday
consumer devices

Thank you
Thank you!
46

FIDO Masterclass

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a FIDO Masterclass

Similar a FIDO Masterclass (20)

Más de FIDO Alliance

Más de FIDO Alliance (8)

Último

Último (20)

FIDO Masterclass