@inproceedings{90889ae44adf417f8f67be03f8f61980,
title = "A Formal Analysis of the FIDO2 Protocols",
abstract = "FIDO2 is the latest member of the Fast IDentity Online (FIDO) protocol suite, which aims at providing unified password-less authentication across the web. We present a formal security analysis of the FIDO2 protocols. We extend the previously presented formalization of the security assumptions and goals of FIDO with FIDO2 specific requirements. We develop a formal model that considers both the CTAP2 and WebAuthn in FIDO2 as a whole. Our formal analysis identifies the minimal security assumptions required for each security goal of FIDO2 to hold. The verification results show FIDO2 fails to achieve some strong authentication properties. The results also reveal that the newly introduced Client PIN mechanism has flaws, and the discovered authenticator rebinding attack and parallel session attacks in UAF still exist in FIDO2.",
keywords = "FIDO2, Formal analysis, Security protocol",
author = "Jingjing Guan and Hui Li and Haisong Ye and Ziming Zhao",
note = "Publisher Copyright: {\textcopyright} 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.; 27th European Symposium on Research in Computer Security, ESORICS 2022 ; Conference date: 26-09-2022 Through 30-09-2022",
year = "2022",
doi = "10.1007/978-3-031-17143-7\_1",
language = "English",
isbn = "9783031171420",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Science and Business Media Deutschland GmbH",
pages = "3--21",
editor = "Vijayalakshmi Atluri and \{Di Pietro\}, Roberto and Jensen, \{Christian D.\} and Weizhi Meng",
booktitle = "Computer Security {\textendash} ESORICS 2022 - 27th European Symposium on Research in Computer Security, Proceedings",
address = "Germany",
}