The FIDO2 protocol is a globally used standard for passwordless authentication, building on an alliance between major players in the online authentication space. While already widely deployed, the standard is still under active development. Since version 2.1 of its CTAP sub-protocol, FIDO2 can potentially be instantiated with post-quantum secure primitives.We provide the first formal security analysis of FIDO2 with the CTAP 2.1 and WebAuthn 2 sub-protocols. Our security models build on work by Barbosa et al. for their analysis of FIDO2 with CTAP 2.0 and WebAuthn 1, which we extend in several ways. First, we provide a more fine-grained security model that allows us to prove more relevant protocol properties, such as guarantees about token binding agreement, the None attestation mode, and user verification. Second, we can prove post-quantum security for FIDO2 under certain conditions and minor protocol extensions. Finally, we show that for some threat models, the downgrade resilience of FIDO2 can be improved, and show how to achieve this with a simple modification.

Abstract Global efforts such as the National Institute of Standards and Technology (NIST)’s post-quantum standardization center on cryptographic primitives like public-key encryption and signature schemes that are secure even in the presence of quantum adversaries. In addition, one must also consider efficient certificate management as new technologies like the Internet of Things and 5G wireless networks rely on them. For example, the IEEE Standard for vehicle-to-vehicle communication depends on implicit certificates. However, the only efficient construction available is over elliptic curves, and hence not quantum-secure. This paper investigates approaches to construct implicit certificate schemes from lattices, employing the NIST Round 3 signature schemes Dilithium and Falcon. We consider emulation of the existing implicit certificate scheme and proceed to more innovative techniques like combining the two schemes or pairing them with encryption. Unfortunately, we encounter problems with each design, due to recurring causes like conflicting secret key and signature sizes, unique sampler requirements and the rigidity of the parameter sets. By explaining each of these issues, this paper will hopefully spark ideas for more successful constructions.

Due to their high efficiency and their strong security properties, lattice-based cryptographic schemes seem to be a very promising post-quantum replacement for currently used public key cryptography. The security of lattice-based schemes has been deeply analyzed mathematically, whereas little effort has been spent on the analysis against implementation attacks. In this paper, we start with the fault analysis of one of the most important cryptographic primitives: signature schemes. We investigate the vulnerability and resistance of the currently most efficientlattice-based signature schemes BLISS (CRYPTO 2013), ring-TESLA (AfricaCrypt 2016), and the GLP scheme (CHES 2012) and their implementations. We consider different kinds of (first-order) randomizing, zeroing, and skipping faults. For each of the signature schemes, we found at least six effective attacks. To increase the security of lattice-based signature schemes, we propose countermeasures for each of the respective attacks.