Secure authentication key sharing between mobile devices based on owner identity

Nishimura, Hideo; Omori, Yoshihiko; Yamashita, Takahiro; Furukawa, Satoru

doi:10.1109/mobisecserv.2018.8311436

Cited by 7 publications

(2 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we mention several other approaches that have been proposed for the recovery of WebAuthn accounts. Nishimura et al [30] propose identity-based key sharing in the context of WebAuthn using a third party to mediate the sharing of keys amongst devices. The third party authenticates the user at each device to ensure keys are not shared to other users.…”

Section: Other Related Workmentioning

confidence: 99%

Asynchronous Remote Key Generation

Frymann

Gardham

Kiefer³

et al. 2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

WebAuthn, forming part of FIDO2, is a W3C standard for strong authentication, which employs digital signatures to authenticate web users whilst preserving their privacy. Owned by users, WebAuthn authenticators generate attested and unlinkable public-key credentials for each web service to authenticate users. Since the loss of authenticators prevents users from accessing web services, usable recovery solutions preserving the original WebAuthn design choices and security objectives are urgently needed.We examine Yubico's recent proposal for recovering from the loss of a WebAuthn authenticator by using a secondary backup authenticator. We analyse the cryptographic core of their proposal by modelling a new primitive, called Asynchronous Remote Key Generation (ARKG), which allows some primary authenticator to generate unlinkable public keys for which the backup authenticator may later recover corresponding private keys. Both processes occur asynchronously without the need for authenticators to export or share secrets, adhering to WebAuthn's attestation requirements. We prove that Yubico's proposal achieves our ARKG security properties under the discrete logarithm and PRF-ODH assumptions in the random oracle model. To prove that recovered private keys can be used securely by other cryptographic schemes, such as digital signatures or encryption schemes, we model compositional security of ARKG using composable games by Brzuska et al. (ACM CCS 2011), extended to the case of arbitrary public-key protocols.As well as being more general, our results show that private keys generated by ARKG may be used securely to produce unforgeable signatures for challenge-response protocols, as used in WebAuthn. We conclude our analysis by discussing concrete instantiations behind Yubico's ARKG protocol, its integration with the WebAuthn standard, performance, and usability aspects. CCS CONCEPTS• Security and privacy → Key management; Multi-factor authentication; Pseudonymity, anonymity and untraceability.

show abstract

Section: Other Related Workmentioning

confidence: 99%

Asynchronous Remote Key Generation

Frymann

Gardham

Kiefer³

et al. 2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Scheme 1 is a key-copy scheme that duplicates a private key stored in the SE/TEE area of a device in a new device. To ensure security, this scheme incorporates various methods to verify the user of a device such as biometric authentication and identity confirmation using a digital certificate, and it uses proximity communication methods to eliminate communications over the Internet such as near-field communication or Bluetooth [2]. In addition, key sharing between two devices can be achieved by a simple device operation using biometric authentication and device-pairing via device-to-device contact.…”

Section: Overview Of Convenience-enhancing Technologymentioning

confidence: 99%

Privilege Sharing and Transfer Based on Passwordless Authentication

Yoshimura

Suga

Omori

et al. 2019

NTT Technical Review

Self Cite

View full text Add to dashboard Cite

Research is underway at the NTT laboratories on an authentication platform that provides both security and convenience. This article describes secure and passwordless authentication platform technology for application to a variety of services that use smartphones and other mobile devices that have grown in popularity. This technology is expected to be applied to a wide array of services to improve their convenience of use.

show abstract