4

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID can be revoked from a centralized system and the end-user provisioned a new ID.

How is this addressed in FIDO UAF / FIDO U2F? Does the user has to individually go and revoke the FIDO enrollment from each service he / she is using to authenticate to using that FIDO device?

Improve this question

1 Answer 1

Reset to default
6

Yes, you have to revoke with each service. One of the design elements of U2F is that a site X cannot in any way test or reveal if site Y is registred on the U2F device. Also, its even designed so if someone has 2 accounts on site X, the site X cannot detect that those 2 accounts are stored on the same U2F device. This to ensure the users privacy so multiple sites cannot track the same user across different sites.

Having a revocation scheme would reveal this fact to the site.

Theres no standarized way of revocation and regeneration, but each site has to implement its own scheme based on security requirements. One scheme can be that using only your username/password, you can revoke your U2F device. To then tie a new U2F device to your account, one scheme could be a physical letter with a one-time code, Another scheme could be SMS in combination with a email. There also possible to issue a revocation certificate. Or even 2 U2F devices could be tied to the same account at signup, where usage of the second U2F device would disable the first, and then you have to order a third one (that then needs to be activated with the service in question and this third becomes the backup key for the now activated second one).

Improve this answer
3
  • 1
    Sabastian, thanks for the explanation. This will make using FIDO in enterprise settings rather cumbersome. Enterprise users typically use the same Strong Auth tokens for multiple services. If the FIDO enrollment has to be revoked for each service individually, there is a good chance that the user may unintentionally forget to revoke one or more service, and thus leaving the enterprise systems open to attack. For enterprise settings, I think there needs to be a centralized way of revoking a FIDO enrollment for ALL enterprise services in one go.
    – сакиб али
    Commented Jan 18, 2015 at 21:43
  • 1
    @SaqibAli Yes. It can be made possible by admin-enrolling the FIDO key at each service instead of allowing user to enroll itself. When the user wants to revoke, they Contact admin, which will ensure the key is revoked at all services the key was admin-enrolled to. Note that the end user has the possibility to register the key at additional services without the admin's permission - this is not a security risk, but bear in mind that if the user enrolls his FIDO key at additional services, he has to itself revoke the key at each additional service.
    – sebastian nielsen
    Commented Jan 18, 2015 at 23:02
  • 3
    Another important factor to consider, is that once a FIDO key has been issued to a specific user, it may NEVER been taken back. It can have been enrolled at multiple private services, thus locking out the user if taken back. Rather, if employment ends, Changes position or user is being fired, you should rather simply revoke all Enterprise services the key is enrolled to - this can often be done from the admin panel without access to the user's FIDO key - often a admin FIDO key can be used for this. Then you allow the user to keep the FIDO key. However, a lended FIDO key may be taken back.
    – sebastian nielsen
    Commented Jan 18, 2015 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .