Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...

@MimmingCodes -- mimming.com

Security Keys are Awesomeand how to use them

Jen TongSecurity AdvocateGoogle Cloud Platform

@MimmingCodesSlides: mimming.com/u2f

About me

How many of you ...● … are Security Engineers?● … use a U2F security key?

Agenda

Passwords are bad :(

FIDO Alliance -- better than passwords

How U2F works

Use it yourself

The problemwith authentication

Authentication

Login:

Password: 123456

123456 password

Source: SplashData

123456Most common password in 2017

password2nd most common password in 2017

Source: SplashData

81%of breaches were due to weak or

stolen passwords

Source: Verizon DBIR 2017

81%of breaches were due to weak or

stolen passwords

28%of phishing attacks were targeted

Source: Verizon DBIR 2017

Normal login

User Service

Normal login

User Service

login - foopassword - 1234

Normal login

User Service

logged in

Phishing

User Service

Fake service

Phishing

User Service

Phishing

User Service

One Time Passwords

Enter this code: 1234

One Time Passwords

Photo credit - Von Alexander Klink

Phishing

User Service

login - foopassword - 1234OTP - 5678

FIDO AllianceBetter than passwords

FIDO is the world’s largest ecosystem for standards-based,

interoperable authentication

W3C’s WebAuthn Spec

Source: WebAuthn spec

FIDO’s U2F Spec

Source: FIDO specs

Public key cryptography devices

Why hardware?● Hardware isolation● Interoperable across devices and services● Fast & easy to use

Transport methods

User Device

Bluetooth

Certification process

How it works

Public key cryptography

Actors

Transport

Registration

Authentication

Public key

Private key

Actors

User Service

Actors

User Service

Actors

User Device Service

User to device transport

User Device

Ceremonies

CeremoniesRegistration

Ceremonies

Authentication

Registration

Ceremonies

Authentication

Registration

Lost key?

Registration ceremony

Registration

Previously authenticatedLogin & passwordLogin & password

Registration CeremonyChallenge: KJ4kAppId: https://foo.com

Challenge: KJ4kAppId: https://foo.comOrigin: https://foo.com

Key handle

Encrypt registration data

Key handle

Challenge: KJ4kOrigin: https://foo.comKey handle: wfn3Cert: ...

Key handle

Challenge: KJ4kOrigin: foo.comKey handle: wfn3Key cert: ...

Verify payload

Authentication ceremony

Authentication

Basic ceremonyLogin & passwordLogin & password

Basic ceremonyChallenge: chBs

Basic ceremonyChallenge: chBsChallenge: chBs

Sign payload

Basic ceremonyChallenge: chBsChallenge: chBs

Challenge: chBsSign payload Verify

payload

Mitigate phishingChallenge: chBsChallenge: chBs

Origin: foo.com

Challenge: chBsOrigin: foo.comSign payload Verify

payload

Prevent tracking across accountsChallenge: chBsKey handle: 6bHc

Challenge: chBsOrigin: foo.comKey handle: 6bHc

Challenge: chBsOrigin: foo.comFind key,

sign payloadVerify

payload

Mitigate authenticator cloningChallenge: chBsKey handle: 6bHc

Challenge: chBsOrigin: foo.comKey handle: 6bHc

Challenge: chBsOrigin: foo.comCounter: 42

Find key, counter++,

sign payload

Counter went upVerify payload

Lost key ‘ceremony’

Lost Key?

Demoregistering & using a key

Source: Yubico U2F Test

Use it yourself

Browser support

Lots of websites support it today

Google Cloud Platform

GSuite

Big list - https://www.dongleauth.info/

Adding it to your stuffaka deployment

Deployment options

Run it yourself

Use 3rd party auth

How Google does it

Run it yourself

Client Server

Run it yourself - Server

Source: GitHub search for 'u2f server'

Client libraries

Run it yourself - Server

Source: Yubico U2F Validation Server

Yubico’s open source server

Client libraries

Code it yourself

Client Server

Code it yourself

Client ServerJavaScript Flexible

Code it yourself - Client

Browser support:

Client - Registration

u2f.register(appId, [{challenge: challenge, version: 'U2F_V2'}], [], function(resp) { if(resp.error) { console.log(resp.errorcode}); return; } // POST resp.clientData // and resp.registrationData to server});

Client - Authentication

u2f.sign( [{challenge: challenge, version: 'U2F_V2'}], [], function(devResp) { let jsonResp = JSON.stringify(devResp); u2fRespInput.value = jsonResp; loginForm.submit(); });

Client libraries for

● Java● Ruby● Python● PHP● C#● C● JavaScript

Code it yourself - Server

Server - Registration (node.js)function registrationChallengeHandler(req, res) { const regReq = u2f.request(APP_ID); req.session.registrationRequest = regReq; return res.send(regReq);}

function registrationVerificationHandler(req, res) { const regRes = u2f.checkRegistration( req.session.registrationRequest, req.body.registrationResponse);

if (regRes.successful) { return res.sendStatus(200); }

return res.send({result});}

Server - Authentication (node.js)function authenticationChallengeHandler(req, res) { const authRequest = u2f.request(APP_ID, keyHandleFromDB()); req.session.authRequest = authRequest;

return res.send(authRequest);}

function authenticationVerificationHandler(req, res) { const result = u2f.checkSignature( req.session.authRequest, req.body.authResponse, publicKeyFromDB());

if (result.successful) { return res.sendStatus(200); }

return res.send({result});}

Let someone else deal with it

BeyondCorpa.k.a. Google Cloud’sIdentity Aware Proxy

Source: GCP's BeyondCorp marketing page

DemoIdentity Aware Proxy on a black box web app

Conclusion

● Passwords aren’t enough● Security keys work● That you should use them yourself● Many options to use

Thank you!

Now go add it to your software so we can reduce pwnage

Slides: https://mimming.com/u2f

Want to learn more? Here's a reading listThese slides: https://mimming.com/u2f

Spec● FIDO Alliance specs● Yubico U2F docs

Keys● A review of several commercial authenticators

Relaying Party (server) libs● Google’s reference implementation (Java)● Node.js

Other cool talks● Google Case Study: Strong Authentication● U can U2F

Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...

Documents

Transcript of Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...

5 Keys for Creating Awesome Content

Understanding the 8 Keys to Security Success

Keys to Network Security & Shocking Statistics

Keys WUSB Security

Strengthening security with secure encryption keys

The Keys to Buying Your Home Awesome Agent - Residential Specialist 206-555-1212 Your name Residential Specialist 206-555-1212.

Security Technologies and Protocols for Asynchronous .../67531/metadc... · security association between two parties, and the distribution of public keys. Public keys allow end systems

Six Keys to Career Security in an Insecure Time

Keys and Certificates on AWS Cloud Security for Enterprises · Keys and Certificates on AWS Cloud Security for Enterprises Seattle AWS Architects & Engineers Meetup August 22, 2016

Get Quality Security Services from Krazy Keys

The Florida Keys offers great snorkeling, awesome ... · The Florida Keys offers great snorkeling, awesome fishing, and family oriented sunset dining. One way to experience the Keys

Section 2.2 – Locks and Keys Digital security often begins with physical security… 1.

Keys to a More Successful Physical Security Program

Keys to Security, IAEA Bulletin, April 2010

Information Security Lesson 9 - Keys - Eric Vanderburg

NIGHT VISION COMPUTER SECURITY USB ENCRYPTION KEYS FOR GOVERNMENT AND MILITARY USB ENCRYPTION KEYS FOR GOVERNMENT AND MILITARY.

Brainloop: Security Policy - Five Keys to User Compliance (White Paper)

User Security Training: Keys to building an effective program

FOUR KEYS TO NAVIGATING THE HARDWARE SECURITY JOURNEY

Keys to Implementing a Successful Security Information Management Solution or Centralized Security Monitoring 1303