FIDO U2F - Revision history

Tom: /* Solutions */

2021-11-01T00:16:47Z

‎Solutions

2021-02-05T19:57:29Z

‎Context

2019-04-12T17:18:16Z

‎Solutions

2018-09-01T00:17:07Z

2018-09-01T00:15:18Z

‎Other external links

2018-08-31T23:55:47Z

2018-08-31T23:54:58Z

‎References

2018-08-31T00:22:11Z

‎Solutions

2018-08-30T23:37:39Z

‎Solutions

2018-08-30T23:34:22Z

‎Solutions

@@ Line 14: / Line 14: @@
 * [[Universal Serial Bus (USB)]] tokens are now widely available, most allow late binding of the user to the [[Web Site]] that requires this factor of [[Authentication]].
 * Other networks, link [[NFC]] or [[Bluetooth]] are offered for small hand-held devices, but have not been as successful as the USB versions.
-* Initially the U2F functionality is available through JavaScript programs in the browser.
+* Initially the U2F functionality is available through [[JavaScript]] programs in the browser.
 * The spec claims that the same functionality could be embedded in [[Native App]]s in the browser, but does not explain how this might be [[Attested]] as trustworthy.
 * The goal of the working group was that modern client device owned by the user would just work without needing additional driver or middleware setup.

@@ Line 3: / Line 3: @@
 ==Context==
-This spec is partially succeeded by [[Web Authentication]].
+* This spec is partially succeeded by [[Web Authentication]].
 ==Problems==

@@ Line 12: / Line 12: @@
 * All solutions depend on [[Late Binding Token]]s to an "account at a particular origin (of the [[Relying Party]], such as http://www.company.com) the device creates a new key pair usable only at that origin and gives the origin the public key to associate with the account."
 * [[Universal Serial Bus (USB)]] tokens are now widely available, most allow late binding of the user to the [[Web Site]] that requires this factor of [[Authentication]].
-* Other networks, link NFC or Bluetooth are offered for small hand-held devices, but have not been as successful as the USB versions.
+* Other networks, link [[NFC]] or [[Bluetooth]] are offered for small hand-held devices, but have not been as successful as the USB versions.
 * Initially the U2F functionality is available through JavaScript programs in the browser.
 * The spec claims that the same functionality could be embedded in [[Native App]]s in the browser, but does not explain how this might be [[Attested]] as trustworthy.

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-A family of standards<ref>FIDO ''Index of /specs/'' https://fidoalliance.org/specs/</ref> for adding more factors to an existing interchange.
+A family of standards<ref name='u2f'>FIDO ''Index of /specs/'' https://fidoalliance.org/specs/</ref> for adding more factors to an existing interchange.
 ==Context==
@@ Line 9: / Line 9: @@
 ==Solutions==
 * All solutions depend on [[Late Binding Token]]s to an "account at a particular origin (of the [[Relying Party]], such as http://www.company.com) the device creates a new key pair usable only at that origin and gives the origin the public key to associate with the account."
 * [[Universal Serial Bus (USB)]] tokens are now widely available, most allow late binding of the user to the [[Web Site]] that requires this factor of [[Authentication]].

@@ Line 31: / Line 31: @@
 *Angelo Liao +1, ''Introducing Web Authentication in Microsoft Edge.'' (2018-07-30) Microsoft https://blogs.windows.com/msedgedev/2018/07/30/introducing-web-authentication-microsoft-edge/
 *Also see the page [[FIDO UAF]] for the Universal [[Authentication]] description.
-*"Why Johnny Doesn’t Use Two Factor: A Two-Phase Usability Study of the FIDO U2F
+*"Why Johnny Doesn’t Use Two Factor: A Two-Phase Usability Study of the FIDO U2F Security Key" https://fc18.ifca.ai/preproceedings/111.pdf
 [[Category:Standard]]
 [[Category:Glossary]]
 [[Category:Authentication]]
 [[Category:Authorization]]

@@ Line 19: / Line 19: @@
 * The U2F device mints an origin-specific public/private key pair based on the origin's protocol (http(s)), host-name and port.
 * The U2F device gives the public key and a Key Handle to the origin online service or website during the user registration step.
-* The U2F signs the registration packet with an [[Attested|Attestation]] to identified the U2F device as trustworthy.
+* The U2F signs the registration packet with an [[Attested|Attestation]] key burned into the U2F device to identified the U2F device as trustworthy.
 * The Key Handle is simply an identifierof a particular key on the U2F device.
 * The [[User Agent]] collects a challenge from the origin with its ID and a channel ID if that exists to hash for the [[Authentication]] step.

← Older revision		Revision as of 23:34, 30 August 2018
Line 23:		Line 23:
	* The U2F device signs the hash of the client data collected for return to the origin server where it is [[Validated]].		* The U2F device signs the hash of the client data collected for return to the origin server where it is [[Validated]].
	* The exact nature of the protection of the private key used above by the U2F device is dependent on the device must indicate the code used to sign.		* The exact nature of the protection of the private key used above by the U2F device is dependent on the device must indicate the code used to sign.
		+	* Because of the various methods used to protect keys, the origin server must recognize the U2F device as one it has [[Attested]] to be secure for its use.
		+