Nok Nok Labs Addresses Potential WebAuthn Protocol Security Concerns

A team of researchers at Paragon Initiative recently shared a few security concerns related to some cryptographic algorithms in WebAuthn—a web authentication API protocol. In an August 23 blog post, the Paragon team provided an overview of the potential issues they feel WebAuthn is exposed to as a result of vulnerabilities with underlying or supported algorithms. The research is thorough, and the effort to educate users is admirable. However, the security concerns should also be considered in context and with the understanding that how the protocol is implemented plays a significant role.

WebAuthn specification supports different algorithms, some of which are stronger than others. That is a challenge faced by virtually every standard. Standards bodies typically strive to address the widest possible audience and cover the widest range of products or services in an effort to maximize adoption and market reach. The need for backward compatibility and interoperability with other platforms and standards opens the door to potential weaknesses that exist in legacy or third-party components.

It is what you do with the standard that matters.

The overall strength of a security solution depends on the availability of necessary security infrastructure elements and—most importantly—the strength of the implementation. A good implementation needs to be flexible and provide a framework to allow service providers to make the best choices based on the strengths of the incoming device requests. In the cases where there are weaker devices involved, additional steps need to be taken to validate incoming data and mitigate the underlying risk.

The article from Paragon raises two primary areas of concern: signature forgery vulnerabilities inherent to RSA PKCS1v1.5 padding, and potential weaknesses in the use of ECDAA. WebAuthn is a web authentication API and web browsers add a layer of complexity, interfaces, and APIs above and beyond the operating system. The expanded attack surface opens the door to a variety of possible attacks that are not a function of WebAuthn itself.

The concerns raised by Paragon are not an issue for products from Nok Nok Labs. Nok Nok Labs has deployed products that implement FIDO protocols globally and at a massive scale for the past 4 years. We endorse high security standards and implementations—and that includes scenarios with WebAuthn as well.

Customers who rely on Nok Nok Labs products can specify acceptable algorithms and authentication characteristics through policy. This enables our customers to detect and potentially block weak implementations and mitigate exposure to risk resulting from weaknesses in specific underlying algorithms. It also allows customers to assign risk scores to specific authenticators that use weak or vulnerable algorithms. Using the risk scores provides an opportunity for customers to require additional step-up authentication for improved security, delay the transaction, or take other appropriate measures to reduce risk and ensure strong security.

Nok Nok Labs gives customers the flexibility to limit exposure to these types of flaws through configuration and policy. We also give customers the ability to identify scenarios that are higher risk and require step-up authentication to provide additional protection.

Nok Nok Labs is a founder and strong supporter of FIDO and we stand by WebAuthn. We also recognize that there are potential security concerns inherent with developing a general standard that provides backwards compatibility and interoperability, and the steps that must be taken at the implementation level to address them.

For further questions or comments, please contact Nok Nok Labs ([email protected]).