Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...

@MimmingCodes -- mimming.com

Security Keys are Awesomeand how to use them

Jen TongSecurity AdvocateGoogle Cloud Platform

@MimmingCodesSlides: mimming.com/u2f

About me

https://twitter.com/MimmingCodes

https://mimming.com/u2f

How many of you ...● … are Security Engineers?● … use a U2F security key?


Agenda

Passwords are bad :(

FIDO Alliance -- better than passwords

How U2F works

Use it yourself

The problemwith authentication


Authentication

Login:

Password: 123456

jen


123456 password

Source: SplashData

https://en.wikipedia.org/wiki/List_of_the_most_common_passwords#SplashData


123456Most common password in 2017

password2nd most common password in 2017

Source: SplashData

https://en.wikipedia.org/wiki/List_of_the_most_common_passwords#SplashData


81%of breaches were due to weak or

stolen passwords

Source: Verizon DBIR 2017

http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/


81%of breaches were due to weak or

stolen passwords

28%of phishing attacks were targeted

Source: Verizon DBIR 2017

http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/


Normal login

User Service


Normal login

User Service

login - foopassword - 1234


Normal login

User Service


logged in


Phishing

User Service

Fake service


Phishing

User Service



One Time Passwords

SMS

Enter this code: 1234


One Time Passwords

Photo credit - Von Alexander Klink

SMS

Enter this code: 1234

https://commons.wikimedia.org/w/index.php?curid=5046441


Phishing

User Service

login - foopassword - 1234OTP - 5678

login - foopassword - 1234OTP - 5678

FIDO AllianceBetter than passwords

“


FIDO is the world’s largest ecosystem for standards-based,

interoperable authentication


W3C’s WebAuthn Spec

Source: WebAuthn spec

New!

https://www.w3.org/TR/webauthn/


FIDO’s U2F Spec

Source: FIDO specs

https://fidoalliance.org/download/


Public key cryptography devices

Why hardware?● Hardware isolation● Interoperable across devices and services● Fast & easy to use


Transport methods

User Device

USB

NFC

Bluetooth


Certification process

How it works


How it works

Public key cryptography

Actors

Transport

Registration

Authentication



Public key

Private key


Actors

User Service


Actors

User Device Service


User to device transport

User Device



User Device

USB



User Device

USB

NFC


Ceremonies


CeremoniesRegistration


Ceremonies

Authentication

Registration


Ceremonies

Authentication

Registration

Lost key?


Registration ceremony

Registration


Previously authenticatedLogin & passwordLogin & password


Registration CeremonyChallenge: KJ4kAppId: https://foo.com



Challenge: KJ4kAppId: https://foo.comOrigin: https://foo.com




Key handle




Key handle

Encrypt registration data




Key handle


Challenge: KJ4kOrigin: https://foo.comKey handle: wfn3Cert: ...




Key handle


Challenge: KJ4kOrigin: foo.comKey handle: wfn3Key cert: ...

Verify payload


Authentication ceremony

Authentication


Basic ceremonyLogin & passwordLogin & password


Basic ceremonyChallenge: chBs


Basic ceremonyChallenge: chBsChallenge: chBs

Sign payload


Basic ceremonyChallenge: chBsChallenge: chBs

Challenge: chBsSign payload Verify

payload


Mitigate phishingChallenge: chBsChallenge: chBs

Origin: foo.com

Challenge: chBsOrigin: foo.comSign payload Verify

payload


Prevent tracking across accountsChallenge: chBsKey handle: 6bHc

Challenge: chBsOrigin: foo.comKey handle: 6bHc

Challenge: chBsOrigin: foo.comFind key,

sign payloadVerify

payload


Mitigate authenticator cloningChallenge: chBsKey handle: 6bHc

Challenge: chBsOrigin: foo.comKey handle: 6bHc

Challenge: chBsOrigin: foo.comCounter: 42

Find key, counter++,

sign payload

Counter went upVerify payload


Lost key ‘ceremony’

Lost Key?

Demoregistering & using a key

Source: Yubico U2F Test

https://demo.yubico.com/u2f

Use it yourself


Browser support


Lots of websites support it today

Google Cloud Platform

GSuite

Big list - https://www.dongleauth.info/

https://www.dongleauth.info/

Adding it to your stuffaka deployment


Deployment options

Run it yourself

Use 3rd party auth

How Google does it


Run it yourself

Client Server


Run it yourself - Server

Source: GitHub search for 'u2f server'

Client libraries

https://github.com/search?utf8=%E2%9C%93&q=u2f+server


Run it yourself - Server

Source: Yubico U2F Validation Server

Yubico’s open source server

Client libraries

https://developers.yubico.com/u2fval/


Code it yourself

Client Server


Code it yourself

Client ServerJavaScript Flexible


Code it yourself - Client

Browser support:


Client - Registration

u2f.register(appId, [{challenge: challenge, version: 'U2F_V2'}], [], function(resp) { if(resp.error) { console.log(resp.errorcode}); return; } // POST resp.clientData // and resp.registrationData to server});


Client - Authentication

u2f.sign( [{challenge: challenge, version: 'U2F_V2'}], [], function(devResp) { let jsonResp = JSON.stringify(devResp); u2fRespInput.value = jsonResp; loginForm.submit(); });


Client libraries for

● Java● Ruby● Python● PHP● C#● C● JavaScript

Code it yourself - Server


Server - Registration (node.js)function registrationChallengeHandler(req, res) { const regReq = u2f.request(APP_ID); req.session.registrationRequest = regReq; return res.send(regReq);}

function registrationVerificationHandler(req, res) { const regRes = u2f.checkRegistration( req.session.registrationRequest, req.body.registrationResponse);

if (regRes.successful) { return res.sendStatus(200); }

return res.send({result});}


Server - Authentication (node.js)function authenticationChallengeHandler(req, res) { const authRequest = u2f.request(APP_ID, keyHandleFromDB()); req.session.authRequest = authRequest;

return res.send(authRequest);}

function authenticationVerificationHandler(req, res) { const result = u2f.checkSignature( req.session.authRequest, req.body.authResponse, publicKeyFromDB());

if (result.successful) { return res.sendStatus(200); }

return res.send({result});}


Let someone else deal with it


BeyondCorpa.k.a. Google Cloud’sIdentity Aware Proxy

Source: GCP's BeyondCorp marketing page

https://cloud.google.com/beyondcorp/

DemoIdentity Aware Proxy on a black box web app


Conclusion

● Passwords aren’t enough● Security keys work● That you should use them yourself● Many options to use


Thank you!

Now go add it to your software so we can reduce pwnage

Slides: https://mimming.com/u2f



Want to learn more? Here's a reading listThese slides: https://mimming.com/u2f

Spec● FIDO Alliance specs● Yubico U2F docs

Keys● A review of several commercial authenticators

Relaying Party (server) libs● Google’s reference implementation (Java)● Node.js

Other cool talks● Google Case Study: Strong Authentication● U can U2F


https://fidoalliance.org/specifications/overview/

https://developers.yubico.com/U2F/

https://github.com/hillbrad/U2FReviews

https://github.com/google/u2f-ref-code

https://github.com/ashtuchkin/u2f

https://www.youtube.com/watch?v=6fzNUSmSpug

https://www.youtube.com/watch?v=vv11XMG5UJg

Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...

Documents

Transcript of Security Keys are Awesome · Security Keys are Awesome and how to use them. Jen Tong Security...