Is there any risk, if a database of U2F device key handles are leaked?
Enrolling a key works by:
- Send Enroll request with "AppID" to U2F device.
- U2F device answers with "Key Handle, Public Key".
Authentication works by:
Send Auth request with "AppID, Key Handle, Challenge" to U2F device. U2F device signs this and returns "Signed Challenge" to server.
"Key handle" is a opaque item, that might be a encrypted private key, that is encrypted by the U2F smart card controller, but it might also be information that is only usable for the smart card controller to regenerate the private key, like a seed that is put into a deterministic RNG that is unique for that U2F device, a HMAC generation routine (Yubico U2F uses this), or it might just be a simple ID that Points to internal storage in the U2F key, but that would limit the number of websites the U2F key can be enrolled with.
According to the standard, the user should be authenticated by username+password Before starting U2F authentication.
But lets say we omit the password completely, and instead allow the user to put in their username, then they are taken to the U2F authentication, and voilá, they are in.
This however, would mean a malicious user could enumerate out all key handles, thus leaking all key handles in database.
Would leaked key handles be a security risk? It seems that it should not be, but since key handles could contain encrypted private keys, they could be (?). A key handle would not be useable by a Another site than its designated AppID anyways, since the U2F device would reject any authentication attempts that uses a "stolen" key handle. However, this is enforced by the client software/browser, since a malicious client software/browser could simply fake the AppID.