27

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various web services. After reading up on U2F I'm starting to really like the idea, but I also noticed that the Fast IDentity Online (FIDO) Alliance (the same organization which created the U2F standard) seems to have another, very similar authentication standard called the Universal Authentication Framework (UAF). At first glance, these two standards seem very similar:

UAF and U2F, illustrated

With both standards, it seems the website requests authentication, the user authenticates with a local device, and the website then accepts this authentication and signs the user in.

The only differences I can see on the surface are that it seems that FIDO is intending for UAF to replace passwords entirely, whereas U2F is only meant to replace the second factor of the authentication process. I'm very unsure as to the reasoning behind this though, given that both authentication mechanisms seem to be so similar from the user's perspective.

How do these standards differ from an implementation and security standpoint?

Improve this question
2
  • 3
    Correct me if I am mistaken but UAF utilizes biometric or PIN, U2F is something you have
    – Ulkoma
    Oct 24, 2014 at 22:12
  • 1
    @Ulkoma The way I see it, both are "something you have". With U2F it's a dongle, and with UAF it's a phone/tablet/other device. The biometric or PIN authentication in UAF happens locally on the device, so from the website's perspective that part of the auth doesn't really matter. Also, from an attacker's perspective it might not matter either. Depending on implementation, it's possible that local device auth could be bypassed if the attacker obtains physical possession of the UAF device. (Especially in the case of biometrics, which can't be used to encrypt a key AFAIK.)
    – Ajedi32
    Feb 26, 2015 at 14:26

1 Answer 1

Reset to default
22

Seems like you've got it pretty much down. Universal Authentication Framework (UAF) is meant as a replacement for simple authentication, and Universal Second Factor (U2F) is meant to replace today's time-based, second factor authentication. While it does seem like the end-user will experience the same experience on both devices, this won't always be the case.

With UAF, the user authenticates a device with the website, and then uses a biometric from that device going forward. The user then only needs to authenticate locally from that device going forward. The website can choose whether or not it will continue to store a password (seems dumb, but it's a choice the site can make).

With U2F the service optionally can request a second factor at anytime they choose. In this case the user would have to have a fob, USB, or second device in order to login/register. This increases the chances that it's only you accessing this account since you would have to have more than one of your devices in order to login. The newest implementation is more secure than an old school time based, 6 digit codes since the cryptographic key being stored is only authorized with the website you set it to. It makes phishing with look a like requests more difficult to accomplish.

Improve this answer
3
  • 3
    Thanks. I was kind of looking for more technical details than that, but I guess I did kind of phrase the question from a user's perspective.
    – Ajedi32
    Oct 25, 2014 at 18:14
  • 1
    @Ajedi32 Whoops, misread I guess. I think in terms of implementation the major difference is that U2F is a more narrow solution, whereas UAF tends to have more flexible implementation. I'm curious how U2F acts on distributed computing environments since it's server tied.
    – Stephen Punwasi
    Oct 25, 2014 at 18:49
  • this probably should be revised as FIDO 2 is out now. IIUC UAF was replaced with CTAP2 and U2F is still supported via CTAP1
    – David 天宇 Wong
    Jan 27, 2020 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .