Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a backdoor on a U2F device, given the protocols and standards used?

If so, how could such backdoors actually work?


A backdoor is actually quite simple: keep track of the secret key used on the device. Either by generating them randomly and storing them after writing to each device, or by generating them all from a known seed. All of the security of a U2F device is dependent on the device key staying secret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.