FB pixel

Paragon reveals cryptographic weaknesses in WebAuthn

Categories Access Control  |  Biometrics News
 

Paragon Initiative Enterprises recently announced the discovery of security flaws in the latest drafts of a standard Web Authentication API called “WebAuthn”, published by the World Wide Web Consortium (W3C) and FIDO Alliance.

The WebAuthn standard is designed to make “unphishable” privacy-preserving authentication available on the Web and reduced reliance on passwords.

The W3C specification defines the FIDO-based API that supposedly enables Web pages to access “WebAuthn” compliant strong cryptographic credentials through browser script. Conceptually, one or more credentials are stored on an authenticator, and each credential is scoped to a single “relying party.”

Authenticators are responsible for ensuring that no operation is performed without the user’s consent. The user agent mediates access to credentials in order to preserve user privacy. Authenticators use attestation to provide cryptographic proof of their properties to the relying party. This specification also describes a functional model of a “WebAuthn” compliant authenticator, including its signature and attestation functionality.

Paragon notes that its analysis of the standard reveals that the latest WebAuthn protocol recommends or requires the implementation of old and weak cryptographic algorithms, that have been known to be vulnerable to attacks for years. Cryptography experts at the firm have disparagingly noted that almost any competent cryptographer should have been able to identify and remedy the vulnerabilities that they had identified earlier in the standard’s design phase.

Paragon is appealing to W3C and FIDO Alliance to fix the error-prone cryptographic designs in WebAuthn, before the standard is finalized. Their recommendations include requiring, or, at least allowing point compression; using deterministic nonces; and hiring cryptographers to review their designs and implementations.

Paragon Initiative Enterprises is a Florida-based company that provides software consulting, application development, code auditing, and security engineering services.

Article Topics

 |   |   | 

Latest Biometrics News

 

European AI compliance project CERTAIN launches

The pan-European project to create AI compliance tools CERTAIN has kicked off its work, with the goal of making European…

 

Signaturit Group acquiring Validated ID for undisclosed sum

Spain-based digital identity and electronic signature provider Validated ID is being acquired by Signaturit Group, a European company offering identity…

 

Social media ban for kids under 13 advances through US Senate committee

U.S. kids under 13 could soon be banned from accessing social media platforms, as an age assurance law makes its…

 

South Africa will invest in DPI, says President

South Africa is planning to invest in digital public infrastructure (DPI) , including the launch of a national digital identity…

 

Sri Lanka: ‘DPI is not just a buzzword’

A robust digital public infrastructure (DPI) framework is central to Sri Lanka’s ongoing digital transformation, while the country’s digital ID…

 

Idiap highlights biometrics research, open-source contributions for 2024

Idiap Research Institute has released its 2024 Scientific Report. Its research covers a wide range of digitally relevant topics, several…

Comments

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Viewed This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events