Slides presented at FIDO KWG Hackathon

1. FIDO Technical Overview
Ki-Eun Shin at LINE Corporation
April 2019

2. 2
1. Backgrounds

3. Password problems
Hard to create and remember Data breach affects other services

4. Feasible solutions
Password managers 2factor authentication (e.g., OTP)
Biometrics Federations and SSO

5. We would like to design a new authentication system
• Easy to use
• Strong against various attacks
• Pluggable and interoperable design
• Privacy preserving

6. 6
2. What is FIDO?
[fáidou]

7. FIDO Specifications
FIDO 1
FIDO 2

8. How FIDO works

9. High level architecture
RP ServerUser Device
Native/Web App
Authenticator
RP Web Server
FIDO Server
FIDO Client
(Platform or browser)
Local
Verifier
Crypto
Module
Attest.
Validator
Assertion
Validator
Metadata Service
FIDO Client API
(JS or Native API)
• RP (Relying Party)
• Service leveraging FIDO authentication
• Metadata Service (MDS)
• Access to latest metadata statements
• Authenticator types (attachment)
• Platform (bound) authenticator
• External (roaming) authenticator

10. Registration flow
RP ServerUser Device
Native/Web App
ASM/Authenticator
RP Web Server
FIDO Server
Local
Verifier
Crypto
Module
Attest.
Validator
Assertion
Validator
Metadata Service
5. requestOperation
1.getRegRequest
2.getRegRequest
4. returnRegRequest
6. verifyUser & getAttestation
FIDO Client
(Platform or browser)
7. callbackOperation
8. sendRegResponse
12. serverResponse
3. returnRegRequest
9.sendRegResponse
11. serverResponse
10. verifyAttestation & store pub key
• Public key pair generation
• Attestation (signature) generation
• Store public key and related info

11. Authentication flow
RP ServerUser Device
Native/Web App
ASM/Authenticator
RP Web Server
FIDO Server
Local
Verifier
Crypto
Module
Attest.
Validator
Assertion
Validator
Metadata Service
5. requestOperation
1.getAuthRequest
2.getAuthRequest
4. returnAuthRequest
6. verifyUser & getAssertion
FIDO Client
(Platform or browser)
7. callbackOperation
8. sendAuthResponse
12. serverResponse
3. returnAuthRequest
9.sendAuthResponse
11. serverResponse
10. verifyAssertion /w pub key
• Signature generation (/w priv key)
• Signature verification

12. FIDO credentials
• Scoped (isolated) to the specific domains (web sites)
• No correlation between services (privacy preserving)
• Public key pairs
• Private keys are stored in client as much as secure way
• Public keys are stored in the server and mapped to the user identifiers
• Generated per service, user id and authenticator
• Private keys never leave the device (client)
• Private keys may be protected with user verification methods

13. 13
3. Discover FIDO

14. Browsers and platforms supports
Platform (OS)
Browsers
Apps
(preview version) (any chromium based browsers)
(Windows 18H2)(Android 7+)
Authenticators
(Safetynet)

15. Who is using FIDO?
Examples

16. 16
4. More Resources

17. Resources for Developers
• W3C WebAuthn specs: https://www.w3.org/TR/webauthn/
• FIDO2 demo web sites (including open sources)
• https://github.com/herrjemand/awesome-webauthn
• FIDO dev forum
• https://groups.google.com/a/fidoalliance.org/forum/#!forum/fido-dev
• Android native FIDO API
• https://developers.google.com/android/reference/com/google/android/gms/fido/Fido
• Windows native WebAuthn API
• https://github.com/Microsoft/webauthn
• FIDO Specs: https://fidoalliance.org/specifications/download/

18. Resources for Planners
• FIDO introduction: https://fidoalliance.org/category/intro-fido/
• FIDO videos: https://fidoalliance.org/content/video/
• FIDO case studies: https://fidoalliance.org/content/case-study/
• Microsoft’s guide for going password-less (video)
• https://www.youtube.com/watch?v=mXJS615IGLM
• Google: WebAuthn and Security keys (video)
• https://www.youtube.com/watch?v=fsFxbC543n8

19. THANK YOU