Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a backdoor on a U2F device, given the protocols and standards used?

If so, how could such backdoors actually work?


1 Answer 1


A backdoor is actually quite simple: keep track of the secret key used on the device. Either by generating them randomly and storing them after writing to each device, or by generating them all from a known seed. All of the security of a U2F device is dependent on the device key staying secret.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .