Security Analysis of an Attractive Online Authentication Standard：FIDO UAF Protocol

FIDO(Fast IDentity Online) Alliance proposed a set of standard in 2014 for change the nature of online authentication. By now, it has drawn attention from many companies, including Google, VISA, Intel etc. In this paper, we analyze the FIDO UAF(Universal Authentication Framework) Protocol, one of the two sets of specifications in the standard. We first present protocols' cryptographic abstractions for the registration and authentication protocols of the FIDO UAF. According to the abstractions, we discuss on selected security goals presented in the standard to study UAF security properties. We also propose three attacks, which the first two are based on an assumption that an attacker can corrupt the software installed on the user device, and the third is based on two users sharing a FIDO roaming authenticator. The results of the attacks are to impersonate the legitimate user to pass the online authentication.

基于FIDO协议的双向动态口令认证方案

为解决当前口令认证缺陷,提出一种基于FIDO协议的双向动态口令认证方案,采用软件令牌的方式实现。对当前动态口令方案进行分析,结合移动终端特点,设计一种基于移动终端的高效双向动态口令认证协议;研究FIDO协议特点,将FIDO协议与双向动态口令结合,实现本地生物认证,进一步加强用户和云服务安全。安全分析结果表明,该方案能够抵御多种网络攻击。