FIDO2 Facing Kleptographic Threats by-Design

In this paper, we analyze the FIDO2 authentication scheme from the point of view of its resilience to kleptographic attacks. We show that despite its spartan design and apparent efforts to make it immune to dishonest protocol participants, the unlinkability features of FIDO2 can be effectively broken without a chance to detect it by observing the interactions. Similarly, a malicious authenticator can enable an adversary to seize the authenticator’s private keys and thereby enable impersonating the authenticator’s owner. As a few components of the FIDO 2 protocol are the source of the problem, we indicate that either their implementation details must be scrutinized during a certification process or one can introduce some minor local changes in the FIDO2 protocol that effectively disable attacks of this kind.