Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a backdoor on a U2F device, given the protocols and standards used?
If so, how could such backdoors actually work?
A backdoor is actually quite simple: keep track of the secret key used on the device. Either by generating them randomly and storing them after writing to each device, or by generating them all from a known seed. All of the security of a U2F device is dependent on the device key staying secret.
