1

From what I understand, the idea of FIDO2 is to use symmetric cryptography, with secret key on the token, and public key on the server. When requesting to connect, the server uses the public key to generate a challenge that can only be solved with the private key, i.e., if the user can solve the challenge, he has the token containing the private key, and is granted access.

  • is that an accurate description of the protocol?

Then, I am curious of:

  • why would not all tokens containing gpg smartcards and a microcontroller for interfacing be implementing FIDO2?

To take an example, why would there be a Nitrokey Pro with a smartcard and microcontroller that cannot perform FIDO2, vs. a Nitrokey FIDO2 for the sole purpose of doing FIDO2, and without smartcard? (see https://www.nitrokey.com/#comparison ) The Nitrokey Pro has both smartcard and microcontroller, so I guess it could emulate whatever FIDO2 protocol, and do the crypto on the smartcard? Am I missing something, or is it possible to do but just 'doable in theory but not implemented currently'?

Improve this question

1 Answer 1

Reset to default
2

afaik FIDO 2 and gpg require two different architectures, thus require two different MCUs. In that the keys are not similar in their padding, and not similarly stored on the key.

If you wish, you might take a look at the technical details of the Pro 2 here, and the FIDO 2 here. Both keys store different kinds of "files" of keys.

Is there a possibility to store an authentication key on the PRO 2 or HSM, maybe, but it was not made for that. You can this question on the Nitrokey support forum, and the people there would know much better.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .