FIDO Alliance: Standards-based Solutions for Simpler, Strong Authentication Jeremy Grant Managing Director, Technology Business Strategy Venable LLP [email protected] @jgrantindc Digital: The Opportunity and the Challenge “Identity is a precursor to access to fintech, yet identity continues to languish in analog forms that are difficult to build upon for the provision of digital services.” 2 THE PROBLEM 3 All Rights Reserved | FIDO Alliance | Copyright 2018 THE WORLD HAS A PASSWORD PROBLEM 4 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW SECURE IS AUTHENTICATION? 5 All Rights Reserved | FIDO Alliance | Copyright 2018 AUTHENTICATION IS OUR BIGGEST PROBLEM 6 All Rights Reserved | FIDO Alliance | Copyright 2018 THE WORLD HAS A PASSWORD PROBLEM 81% Data breaches in 65% 2016 that involved Increase in 1,579 weak, default, or phishing attacks Breaches in 2017, 1 stolen passwords over the number of a 45% increase attacks recorded over 20163 in 20152 CLUMSY | HARD TO REMEMBER | NEED TO BE CHANGED ALL THE TIME 1Verizon 2017 Data Breach Report |2Anti-Phishing Working Group | 3Identity Theft Resource Center 2017 7 All Rights Reserved | FIDO Alliance | Copyright 2018 2017 DATA BREACHES Number of Data Breaches Continues to Soar over 2016 Figures 1579 Breaches in 2017, an increase of 44.7 percent over last year's record pace 1Identity Theft Resource Center 2017 8 All Rights Reserved | FIDO Alliance | Copyright 2018 ONE-TIME PASSCODES Improve security but aren’t easy enough to use SMS Token User Still Reliability Necklace Confusion Phishable 9 All Rights Reserved | FIDO Alliance | Copyright 2018 ATTACKS AGAINST SMS OTPS ON THE RISE “Whenever possible, people should also avoid using text messages to receive one-time passwords. Instead, they should rely on cryptographically based security keys as a second authentication factor” Ars Technica, April 2017 10 All Rights Reserved | FIDO Alliance | Copyright 2018 THE WORLD HAS A “SHARED SECRETS” PROBLEM 11 All Rights Reserved | FIDO Alliance | Copyright 2018 THE “SHARED SECRET” (AKA “WHAT YOU KNOW”) IS BROKEN WE NEED A NEW AUTHENTICATION MODEL “WHAT YOU HAVE” (+ “WHAT YOU ARE”) 12 All Rights Reserved | FIDO Alliance | Copyright 2018 HIGH-ASSURANCE STRONG AUTHENTICATION High-assurance strong authentication = Use of two + factors At least one leverages public key cryptography Not susceptible to phishing, man-in-the-middle and/or other attacks targeting credentials Javelin Strategy & Research, 2017 State of Authentication Report 13 All Rights Reserved | FIDO Alliance | Copyright 2018 THE NEW MODEL Fast IDentity Online open standards for simpler, stronger authentication using public key cryptography 14 All Rights Reserved | FIDO Alliance | Copyright 2018 THE SOLUTION: FIDO AUTHENTICATION 15 All Rights Reserved | FIDO Alliance | Copyright 2018 VIDEO – WHAT IS FIDO? https://youtu.be/5ZIQabDrnT0 16 All Rights Reserved | FIDO Alliance | Copyright 2018 THE FACTS ON FIDO The FIDO Alliance is an open Today, its members provide industry association of over the world’s largest ecosystem 250 organizations with a for standards-based, focused mission: interoperable authentication AUTHENTICATION 500+ FIDO Certified solutions STANDARDS Available to protect 3 BILLION based on public key cryptography user accounts worldwide to solve the password problem 17 All Rights Reserved | FIDO Alliance | Copyright 2018 LEADING THE EFFORT CONSUMER ELECTRONICS SECURITY & BIOMETRICS HIGH-ASSURANCE SERVICES 18 All Rights Reserved | FIDO Alliance | Copyright 2018 INDUSTRY PARTNERSHIPS 19 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO Standards FIDO2 Project FIDO UAF (ITU x.1277) CTAP WebAuthn FIDO U2F (ITU x.1278) (W3C Standard) (ITU x.1278) 20 All Rights Reserved | FIDO Alliance | Copyright 2018 Strong THE OLD PARADIGM SECURITY Weak Poor Easy USABILITY 21 All Rights Reserved | FIDO Alliance | Copyright 2018 Strong authentication THE FIDO PARADIGM SECURITY Weak Poor Easy USABILITY 22 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW FIDO WORKS 23 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW OLD AUTHENTICATION WORKS ONLINE CONNECTION The user authenticates themselves online by presenting a human-readable “shared secret” 24 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW FIDO AUTHENTICATION WORKS LOCAL CONNECTION The user authenticates “locally” to their device (by various means) The device authenticates the user online using public key cryptography ONLINE CONNECTION 25 All Rights Reserved | FIDO Alliance | Copyright 2018 CLOUD AUTHENTICATION Risk Analytics Internet Something Device Authentication Online Service 26 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW DOES FIDO WORK? Authenticator User verification Device FIDO Authentication Online Service 27 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW DOES FIDO WORK? Challenge Public key User verification Authenticator FIDO Authentication Require user gesture before private key can be used Private key Online Service dedicated to one app (Signed) Response … 28 All Rights Reserved | FIDO Alliance | Copyright 2018 HOW DOES FIDO WORK? User verification Authenticator FIDO Authentication Online Service … SE … 29 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO REGISTRATION 1 2 3 Invitation New Keys Sent Created User is in a User Approval Session Or New Account 4 Flow Registration Complete Pubic Key Registered With Online Server 30 All Rights Reserved | FIDO Alliance | Copyright 2018 IMPORTANT DATA FOR SERVICE PROVIDERS How is the key protected (TPM, SE, TEE, …)? Which user verification method is used? User verification Authenticator FIDO Authentication Online Service … SE … 31 All Rights Reserved | FIDO Alliance | Copyright 2018 ATTESTATION + METADATA Signed Attestation Object Metadata FIDO Registration Verify using trust anchor included in Metadata Private attestation key Understand Authenticator security characteristic by looking into Metadata from mds.fidoalliance.org 32 All Rights Reserved | FIDO Alliance | Copyright 2018 USER EXPERIENCES 33 All Rights Reserved | FIDO Alliance | Copyright 2018 EXPERIENCES ADDRESS ARRAY OF USE CASES FIDO standards provide support for user-friendly, privacy-aware user experiences across platforms to meet varying requirements PASSWORDLESS EXPERIENCES SECOND FACTOR EXPERIENCES • Biometrics authn via mobile device • External token to PC (USB, BLE) • Biometric authn via PC • External token to mobile device (NFC/BLE) • Biometrics authn to PC via mobile device • Embedded second factor on PC 34 All Rights Reserved | FIDO Alliance | Copyright 2018 PASSWORDLESS AUTHENTICATION TO MOBILE APPLICATIONS USING BUILT-IN AUTHENTICATORS 35 All Rights Reserved | FIDO Alliance | Copyright 2018 PASSWORDLESS AUTHENTICATION TO WEB APPLICATIONS/ PLATFORMS ON A PC USING BUILT-IN AUTHENTICATORS 36 All Rights Reserved | FIDO Alliance | Copyright 2018 PASSWORDLESS AUTHENTICATION TO WEB APPLICATIONS/PLATFORMS ON A PC USING EXTERNAL AUTHENTICATOR Client-to-Authenticator Protocol (CTAP) 37 All Rights Reserved | FIDO Alliance | Copyright 2018 SECOND FACTOR AUTHENTICATION TO WEB APPLICATIONS/ PLATFORMS ON A PC USING EXTERNAL AUTHENTICATOR 38 All Rights Reserved | FIDO Alliance | Copyright 2018 SECOND FACTOR AUTHENTICATION TO WEB APPLICATIONS ON A PC USING BUILT-IN AUTHENTICATORS 39 All Rights Reserved | FIDO Alliance | Copyright 2018 SECOND FACTOR AUTHENTICATION TO MOBILE APPLICATIONS USING EXTERNAL AUTHENTICATORS 40 All Rights Reserved | FIDO Alliance | Copyright 2018 SIMPLER AUTHENTICATION Reduces reliance on Single gesture Works with commonly Same authentication Fast and convenient complex passwords to log on used devices on multiple devices 41 All Rights Reserved | FIDO Alliance | Copyright 2018 STRONGER AUTHENTICATION Based on public No link-ability between key cryptography services or accounts Biometrics, if used, Keys stay never leave device on device No server-side No 3rd party in shared secrets the protocol 42 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO DELIVERS ON KEY PRIORITIES Security Usability Privacy Interoperability 43 All Rights Reserved | FIDO Alliance | Copyright 2018 ADVANTAGES FOR DEPLOYING ORGANIZATIONS Open Standards ROI FIDO-enable Securely access from No more one-off Increases future- services once any trusted device integrations proofing Unique FIDO Benefits Lower total cost Lower breach risks and Increases choice of Low-friction user of ownership potential damages authenticators for users experience 44 All Rights Reserved | FIDO Alliance | Copyright 2018 WHERE’S FIDO IN THE MARKET? 45 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO CROSS-PLATFORM SUPPORT 46 All Rights Reserved | FIDO Alliance | Copyright 2018 SAMPLE: FIDO-ENABLED SERVICES AVAILABLE TO PROTECT 3.5 BILLION ACCOUNTS WORLDWIDE 47 All Rights Reserved | FIDO Alliance | Copyright 2018 BACKED BY CERTIFICATION (>500) • Functional Certification (End-to-End): • Conformance Testing • Interoperability Testing • Authenticator Security Certification Levels • How well do you protect the private key? • 3rd-party laboratory verification • Complimented by new Biometric Component certification • Universal Server: • Ensures compatibility with all FIDO Certified Authenticators 48 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO CERTIFIED ECOSYSTEM (SAMPLE) PHONES, PCs, & BROWSERS SECURITY KEYS CLOUD/SERVER SOLUTIONS 49 All Rights Reserved | FIDO Alliance | Copyright 2018 FIDO AND REGULATION 50 All Rights Reserved | FIDO Alliance | Copyright 2018 AUTHENTICATION IS IMPORTANT TO GOVERNMENT 1) Protects