FB pixel

Paragon reveals cryptographic weaknesses in WebAuthn

Categories Access Control  |  Biometrics News

Paragon Initiative Enterprises recently announced the discovery of security flaws in the latest drafts of a standard Web Authentication API called “WebAuthn”, published by the World Wide Web Consortium (W3C) and FIDO Alliance.

The WebAuthn standard is designed to make “unphishable” privacy-preserving authentication available on the Web and reduced reliance on passwords.

The W3C specification defines the FIDO-based API that supposedly enables Web pages to access “WebAuthn” compliant strong cryptographic credentials through browser script. Conceptually, one or more credentials are stored on an authenticator, and each credential is scoped to a single “relying party.”

Authenticators are responsible for ensuring that no operation is performed without the user’s consent. The user agent mediates access to credentials in order to preserve user privacy. Authenticators use attestation to provide cryptographic proof of their properties to the relying party. This specification also describes a functional model of a “WebAuthn” compliant authenticator, including its signature and attestation functionality.

Paragon notes that its analysis of the standard reveals that the latest WebAuthn protocol recommends or requires the implementation of old and weak cryptographic algorithms, that have been known to be vulnerable to attacks for years. Cryptography experts at the firm have disparagingly noted that almost any competent cryptographer should have been able to identify and remedy the vulnerabilities that they had identified earlier in the standard’s design phase.

Paragon is appealing to W3C and FIDO Alliance to fix the error-prone cryptographic designs in WebAuthn, before the standard is finalized. Their recommendations include requiring, or, at least allowing point compression; using deterministic nonces; and hiring cryptographers to review their designs and implementations.

Paragon Initiative Enterprises is a Florida-based company that provides software consulting, application development, code auditing, and security engineering services.

Article Topics

 |   |   | 

Latest Biometrics News


Could be 25 years before TSA gets facial recognition in all US airports

The Transportation Security Administration (TSA) foresees significant delays in implementing facial recognition across U.S. airports if revenue continues to be…


Single solution for regulating AI unlikely as laws require flexibility and context

There is no more timely topic than the state of AI regulation around the globe, which is exactly what a…


Indonesia’s President launches platform to drive digital ID and service integration

In a bid to accelerate digital transformation in Indonesia, President Joko Widodo launched the Indonesian government’s new technology platform, INA…


MFA and passwordless authentication effective against growing identity threats

A new identity security trends report from the Identity Defined Security Alliance (IDSA) highlights the challenges companies continue to face…


Zighra behavioral biometrics contracted for Canadian government cybersecurity testing

Zighra has won a contract with Shared Services Canada (SSC) to protect digital identities with threat detection and Zero Trust…


Klick Labs develops deepfake detection method focusing on vocal biomarkers

The rise in deepfake audio technology has significant threats in various domains, such as personal privacy, political manipulation, and national…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events