Emulating U2F authenticator devices

Abstract

Password authentication has been made more secure by adding additional factors. Unfortunately, popular two-factor authentication methods are vulnerable to attacks themselves. Therefore, the FIDO alliance proposed Universal Second Factor (U2F), an open standard aiming for unified interfaces, secure protocols, and hardware-backed tokens for authentication. However, U2F requires the user to purchase and constantly carry yet another distinct device. We propose an enhancement to U2F making it more user friendly. First, we enable the use of existing cryptographic devices a user already carries around (e. g. a bank card or her smartphone). Second, we provide increased token mobility by enabling remote authenticator tokens. Our showcases demonstrate logging into a web application as well as logging into Microsoft's Windows 10 with a cryptographic smart card via card reader or NFC, Austria's eID, a smartphone, a cloud key service, and a remote U2F token. Our evaluations indicate that our approach is more usable and easier to deploy than stock U2F while it keeps its security features intact. Only a few additional risks are induced by the underlying cryptographic devices. All in all, we believe that our enhancements can push acceptance of U2F even further and thus, make everyone benefit from state-of-the-art authentication.