Emulating U2F authenticator devices

Florian Reimair, Christian Kollmann, Alexander Marsalek

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Abstract

Password authentication has been made more secure by adding additional factors. Unfortunately, popular two-factor authentication methods are vulnerable to attacks themselves. Therefore, the FIDO alliance proposed Universal Second Factor (U2F), an open standard aiming for unified interfaces, secure protocols, and hardware-backed tokens for authentication. However, U2F requires the user to purchase and constantly carry yet another distinct device. We propose an enhancement to U2F making it more user friendly. First, we enable the use of existing cryptographic devices a user already carries around (e. g. a bank card or her smartphone). Second, we provide increased token mobility by enabling remote authenticator tokens. Our showcases demonstrate logging into a web application as well as logging into Microsoft's Windows 10 with a cryptographic smart card via card reader or NFC, Austria's eID, a smartphone, a cloud key service, and a remote U2F token. Our evaluations indicate that our approach is more usable and easier to deploy than stock U2F while it keeps its security features intact. Only a few additional risks are induced by the underlying cryptographic devices. All in all, we believe that our enhancements can push acceptance of U2F even further and thus, make everyone benefit from state-of-the-art authentication.
Original languageEnglish
Title of host publication2016 IEEE Conference on Communications and Network Security (CNS 2016)
Number of pages9
ISBN (Electronic)978-1-5090-3065-1
Publication statusPublished - 19 Oct 2016

Fingerprint

Authentication
Smartphones
Smart cards
Hardware

Keywords

  • U2F
  • emulation
  • two-factor authentication
  • security modules

Cite this

Reimair, F., Kollmann, C., & Marsalek, A. (2016). Emulating U2F authenticator devices. In 2016 IEEE Conference on Communications and Network Security (CNS 2016)

Emulating U2F authenticator devices. / Reimair, Florian; Kollmann, Christian; Marsalek, Alexander.

2016 IEEE Conference on Communications and Network Security (CNS 2016). 2016.

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Reimair, F, Kollmann, C & Marsalek, A 2016, Emulating U2F authenticator devices. in 2016 IEEE Conference on Communications and Network Security (CNS 2016).
Reimair F, Kollmann C, Marsalek A. Emulating U2F authenticator devices. In 2016 IEEE Conference on Communications and Network Security (CNS 2016). 2016
Reimair, Florian ; Kollmann, Christian ; Marsalek, Alexander. / Emulating U2F authenticator devices. 2016 IEEE Conference on Communications and Network Security (CNS 2016). 2016.
@inproceedings{00f8e8905cac47db97153bb1c8002b9d,
title = "Emulating U2F authenticator devices",
abstract = "Password authentication has been made more secure by adding additional factors. Unfortunately, popular two-factor authentication methods are vulnerable to attacks themselves. Therefore, the FIDO alliance proposed Universal Second Factor (U2F), an open standard aiming for unified interfaces, secure protocols, and hardware-backed tokens for authentication. However, U2F requires the user to purchase and constantly carry yet another distinct device. We propose an enhancement to U2F making it more user friendly. First, we enable the use of existing cryptographic devices a user already carries around (e. g. a bank card or her smartphone). Second, we provide increased token mobility by enabling remote authenticator tokens. Our showcases demonstrate logging into a web application as well as logging into Microsoft's Windows 10 with a cryptographic smart card via card reader or NFC, Austria's eID, a smartphone, a cloud key service, and a remote U2F token. Our evaluations indicate that our approach is more usable and easier to deploy than stock U2F while it keeps its security features intact. Only a few additional risks are induced by the underlying cryptographic devices. All in all, we believe that our enhancements can push acceptance of U2F even further and thus, make everyone benefit from state-of-the-art authentication.",
keywords = "U2F, emulation, two-factor authentication, security modules",
author = "Florian Reimair and Christian Kollmann and Alexander Marsalek",
year = "2016",
month = "10",
day = "19",
language = "English",
booktitle = "2016 IEEE Conference on Communications and Network Security (CNS 2016)",

}

TY - GEN

T1 - Emulating U2F authenticator devices

AU - Reimair, Florian

AU - Kollmann, Christian

AU - Marsalek, Alexander

PY - 2016/10/19

Y1 - 2016/10/19

N2 - Password authentication has been made more secure by adding additional factors. Unfortunately, popular two-factor authentication methods are vulnerable to attacks themselves. Therefore, the FIDO alliance proposed Universal Second Factor (U2F), an open standard aiming for unified interfaces, secure protocols, and hardware-backed tokens for authentication. However, U2F requires the user to purchase and constantly carry yet another distinct device. We propose an enhancement to U2F making it more user friendly. First, we enable the use of existing cryptographic devices a user already carries around (e. g. a bank card or her smartphone). Second, we provide increased token mobility by enabling remote authenticator tokens. Our showcases demonstrate logging into a web application as well as logging into Microsoft's Windows 10 with a cryptographic smart card via card reader or NFC, Austria's eID, a smartphone, a cloud key service, and a remote U2F token. Our evaluations indicate that our approach is more usable and easier to deploy than stock U2F while it keeps its security features intact. Only a few additional risks are induced by the underlying cryptographic devices. All in all, we believe that our enhancements can push acceptance of U2F even further and thus, make everyone benefit from state-of-the-art authentication.

AB - Password authentication has been made more secure by adding additional factors. Unfortunately, popular two-factor authentication methods are vulnerable to attacks themselves. Therefore, the FIDO alliance proposed Universal Second Factor (U2F), an open standard aiming for unified interfaces, secure protocols, and hardware-backed tokens for authentication. However, U2F requires the user to purchase and constantly carry yet another distinct device. We propose an enhancement to U2F making it more user friendly. First, we enable the use of existing cryptographic devices a user already carries around (e. g. a bank card or her smartphone). Second, we provide increased token mobility by enabling remote authenticator tokens. Our showcases demonstrate logging into a web application as well as logging into Microsoft's Windows 10 with a cryptographic smart card via card reader or NFC, Austria's eID, a smartphone, a cloud key service, and a remote U2F token. Our evaluations indicate that our approach is more usable and easier to deploy than stock U2F while it keeps its security features intact. Only a few additional risks are induced by the underlying cryptographic devices. All in all, we believe that our enhancements can push acceptance of U2F even further and thus, make everyone benefit from state-of-the-art authentication.

KW - U2F

KW - emulation

KW - two-factor authentication

KW - security modules

M3 - Conference contribution

BT - 2016 IEEE Conference on Communications and Network Security (CNS 2016)

ER -