FIDO2 authentication

Fast ID Online (FIDO)

What is FIDO authentication?

The beginning of a new direction for MFA, The FIDO U2F (Universal Second Factor) standard arrived in the nick of time in 2014 after good work by an industry consortium including PayPal, and a protocol, U2F, developed by Google and hardware maker Yubico. Under this, users still have passwords, but these are complemented by a hardware token cryptographically bound to the site using public key encryption (PKE). FIDO itself is derived from the Latin word fido, meaning "to trust."

What makes FIDO authentication secure?

Public Key Encryption (PKE): The FIDO U2F protocol utilizes pairs of public and private keys unique to each login to verify identity without transmitting secrets over the network. The latter part is important. There is no credential to steal using AiTM.

Why was there a need for FIDO authentication?

It's hard to imagine that barely a decade ago, using Multi-Factor Authentication (MFA) in an enterprise setting was seen as being cautious. The concept of a second factor had been around for years in the form of codes transmitted over a network or proprietary tokens but had struggled to shake off a reputation for being expensive and complex to implement.

However, the crisis point was the realization that traditional MFA was no longer secure. The problem was that while generating a Time-based One-Time Password (TOTP) random code sounds secure, you still need to transmit it over a public network for the whole idea to be practical. At that point, it becomes vulnerable to interception, which criminals had increasingly figured out how to do. The industry needed something different and it needed it quickly or it would end up back where it started with the insecurity of one-factor passwords.

Before FIDO authentication

Pre-FIDO forms of MFA included codes sent via the SMS cell network or email, TOTP codes generated by authenticator apps and, later, push notifications.  SMS codes were quickly beaten by a range of hacks and are no longer used in enterprises. However, both authenticator apps and push notification are still in use. While not perfect, they can provide medium-level security in some environments or be deployed as a fall back option.

How attackers undermined first-generation MFA

  • Adversary-in-the-Middle (AiTM) Phishing: A sophisticated attack vector in which an attacker uses phishing trickery to insert themselves between the user and the target domain to capture the code as it is transmitted.

  • MFA fatigue attacks: Having stolen a user's password, they bombard them with dozens of push notifications in the hope that they will eventually get frustrated or confused and tap 'Approve'.

  • SIM Swapping: Intercepting SMS messages directly at the telecommunications layer by exploiting flaws in Signaling System No. 7 (SS7), the protocol used to route cellular calls and texts. Another technique is to de-register the authorized handset, directing codes to a malicious replacement handset under the control of the attackers. One of the reasons why general consensus is that SMS for 2FA is not secure.

  • On-device malware: An obvious hack that just captures the TOTP code on the device as it is generated, forwarding it in real time.

How FIDO authentication has evolved

FIDO 1.0 U2F had limitations

The drawback was that you needed to give everyone using it a physical token and these cost up to $50 each. It was incredibly secure but not likely to solve the MFA problem across thousands of employees. However, it did show the power of introducing PKE and origin binding into MFA, something which set the scene for later advances.

How FIDO 2 changed the story

The development of FIDO2 and the Client to Authenticator Protocol (CTAP2) in 2018 did something radical. Unlike FIDO U2F, it removed the need for traditional passwords. The factors involved in MFA could now be embedded inside a device (stored in a TPM), authenticated to using biometrics, for example.

  • Web Authentication (WebAuthn):  a JavaScript W3C web API rolled out across web browsers to replace passwords with PKE stored on device and origin bound to a login/website.

  • Client to Authenticator Protocol 2 (CTAP2): The protocol that binds the whole thing together in conjunction with WebAuthn by allowing users to authenticate biometrically, via PIN, or using a physical key, in a way that also eliminates the need for usernames and passwords.

  • Trusted Platform Module (TPM): A secure crypto-processor embedded inside a computer system that can act as the primary security factor under FIDO2, eliminating the necessity of traditional passwords.

Further advances in FIDO2 authentication

  • Passkeys: Designed primarily for consumers, Passkeys allow a public-private key pair to be stored in the cloud and synced across accounts for the sake of convenience. This breaks the principle of device-bound keys, which has made it less appealing to enterprise security. However, by abolishing passwords for millions of consumers, it has had the effect of educating employees into the world of FIDO2 by the back door.  Importantly, enterprises can still use them in a bound form, for example inside a TPM.

  • FIDO Level 3+: A specialized FIDO security specification that appeared in 2021 to enforce physical tamper-resistance standards directly on hardware security keys using specialized storage chips. However, this isn't just tamper-resistance for security keys. FIDO Level 3+: also covers devices such as smartphones and laptops that meet the required specification. The spec also resists side-channel attacks using electrical inference as well as devices compromised by malware.

Active Directory (AD) and FIDO2

Out of the box, AD lacks support for MFA, something which reflects the fact it was developed as a network directory service rather than a security system. To AD's designers, security was a perimeter security problem, not a directory problem, and was best handled elsewhere. This means AD networks need to implement AD using some kind of overlay.

For years, this was limited to first-generation MFA (TOTP codes and push) extended by FIDO to hardware security keys. FIDO2 has transformed the available options, which UserLock supports from version 13.1 (beta).

This includes support for FIDO2 hardware and NFC keys with biometrics (including YubiKey Bio), backed by CTAP2 PIN key verification as an added protection. It also allows self-service enrollment through UserLock MFA onboarding while FIDO2 MFA can be deployed in air-gapped and offline environments.