Public-Key Cryptography in FIDO Flashcards

What is the primary benefit of public-key cryptography in FIDO authentication?

Answer: It eliminates shared secrets

Public-key cryptography in FIDO eliminates the need for shared secrets, such as passwords, between the user and the service provider. Instead, the user's device proves identity by signing a challenge with its private key, which the service verifies using the publicly registered key. This design prevents credential theft from server breaches and phishing attacks, as no secret is ever transmitted or stored on the server.

Which cryptographic method does FIDO use for authentication?

Answer: Asymmetric cryptography

FIDO authentication uses asymmetric cryptography, which is another term for public-key cryptography. This method involves a pair of keys: a private key kept secret on the user's device and a public key shared with the online service. This allows for secure challenge-response authentication where the private key never leaves the device, making it highly resistant to credential theft and impersonation.

What role does the private key play in FIDO authentication?

Answer: It is stored securely on the device

In FIDO authentication, the private key is generated and stored securely on the user's authenticator device, such as a smartphone's secure enclave or a hardware security key. It never leaves the device and is used to cryptographically sign authentication challenges. This ensures that the user's identity is proven without the private key ever being exposed to the server or potential attackers.

How does the public key in FIDO authentication improve security?

Answer: It verifies authentication requests

The public key in FIDO authentication is registered with the online service and is used to verify the cryptographic signature generated by the user's private key during an authentication request. This verification process confirms that the request originated from the legitimate user's device without requiring the server to ever know the private key. This separation of keys significantly enhances security by preventing credential compromise even if the server is breached.

Which security measure protects private keys in FIDO authentication?

Answer: Secure hardware storage

FIDO private keys are protected by secure hardware storage, such as a Trusted Platform Module (TPM), Secure Enclave, or a dedicated hardware security key. This ensures that the private key is generated, stored, and used in an isolated environment, making it extremely difficult for malware or attackers to extract or compromise it. This hardware-backed security is a cornerstone of FIDO's robust protection.

Why is public-key cryptography essential for passwordless authentication?

Answer: It removes password dependency

Public-key cryptography is essential for passwordless authentication because it allows users to prove their identity without relying on shared secrets like passwords. Instead, the user's device uses its private key to sign a challenge, which the server verifies with the public key. This completely removes the need for passwords and their associated vulnerabilities, offering a more secure and convenient login experience.