Mediaspace scheduled maintenance: Aug 25, 2026 07:00 - 12:00 AM. During this time, videos will be temporarily unavailable. Check status updates.

Lecture

WebAuthn: Yubico's Proposal Analysis

Description

This lecture delves into the concept of asynchronous remote key generation, focusing on Yubico's proposal to enhance web authentication. It explores the challenges of password-based authentication, the introduction of multi-factor authentication, and the birth of WebAuthn. The presentation covers the registration and authentication processes without passwords, the properties and challenges of WebAuthn, and the solution proposed by Yubico. The discussion includes a security analysis, performance evaluation, and a detailed explanation of the setup, registration, and recovery phases. Additionally, the lecture examines the security properties of ARKG, such as secret key security and public key unlinkability, and its composability with generic public key protocols.

This video is available exclusively on Mediaspace for a restricted audience. Please log in to MediaSpace to access it if you have the necessary permissions.

Watch on Mediaspace

Instructor

Serge Vaudenay

Serge Vaudenay entered at the Ecole Normale Supérieure in 1989 with a major in mathematics. He earned his agrégation (secondary teaching degree) in mathematics in 1992, then a PhD in Computer Science at the University of Paris 7 - Denis Diderot in 1995. He subsequently became a senior research fellow at the CNRS, prior to being granted his habilitation à diriger des recherches (a postdoctoral degree authorizing the recipient to supervise doctoral students). In 1999, he was appointed as a Professor at the EPFL, where he created the Security and Cryptography Laboratory.

Official source

Related concepts (32)

Key (cryptography)

A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key can be different sizes and varieties, but in all cases, the strength of the encryption relies on the security of the key being maintained. A key's security strength is dependent on its algorithm, the size of the key, the generation of the key, and the process of key exchange.

Multi-factor authentication

Multi-factor authentication (MFA; two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism. MFA protects personal data—which may include personal identification or financial assets—from being accessed by an unauthorized third party that may have been able to discover, for example, a single password.

Mutual authentication

Mutual authentication or two-way authentication (not to be confused with two-factor authentication) refers to two parties authenticating each other at the same time in an authentication protocol. It is a default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS). Mutual authentication is a desired characteristic in verification schemes that transmit sensitive data, in order to ensure data security. Mutual authentication can be accomplished with two types of credentials: usernames and passwords, and public key certificates.

Public key fingerprint

In public-key cryptography, a public key fingerprint is a short sequence of bytes used to identify a longer public key. Fingerprints are created by applying a cryptographic hash function to a public key. Since fingerprints are shorter than the keys they refer to, they can be used to simplify certain key management tasks. In Microsoft software, "thumbprint" is used instead of "fingerprint." A public key fingerprint is typically created through the following steps: A public key (and optionally some additional data) is encoded into a sequence of bytes.

Public-key cryptography

Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic algorithms based on mathematical problems termed one-way functions. Security of public-key cryptography depends on keeping the private key secret; the public key can be openly distributed without compromising security.

Related lectures (35)

Cryptography Basics

Introduces cryptography basics, covering encryption, data integrity, error detection, digital signatures, and authentication.

Cryptographic Security Fundamentals

Covers cryptographic security fundamentals, including collision search algorithms, public-key cryptography, and risks of underestimating collision attacks.

Secure Communications: TLS and Security Protocols

Explores TLS, security protocols, synchronization, fair termination, and secure communication applications.

Public-Key Cryptography: Post-Quantum and Access Control

Explores public-key cryptography, post-quantum systems, and access control mechanisms in depth.

Conditional Access II