CoChat
Sign Up
Cited by 23Advanced Authentication Protocols SecurityUser Authentication and Security SystemsBiometric Identification and Security

The DOI matches its Crossref record.

Security analysis of an attractive online authentication standard: FIDO UAF protocol

Hu, Kexin, Zhang, Zhenfeng·2016·China Communications
DOI 10.1109/cc.2016.7897543
Open this paper in CoChat — free account

Abstract

FIDO (Fast IDentity Online) Alliance proposed a set of standard in 2014 for change the nature of online authentication. By now, it has drawn attention from many companies, including Google, VISA, Intel etc. In this paper, we analyze the FIDO UAF (Universal Authentication Framework) Protocol, one of the two sets of specifications in the standard. We first present protocols' cryptographic abstractions for the registration and authentication protocols of the FIDO UAF. According to the abstractions, we discuss on selected security goals presented in the standard to study UAF security properties. We also propose three attacks, which the first two are based on an assumption that an attacker can corrupt the software installed on the user device, and the third is based on two users sharing a FIDO roaming authenticator. The results of the attacks are to impersonate the legitimate user to pass the online authentication.

Overview

Integrity signals

Registry

Crossref · 10.1109/cc.2016.7897543

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cited by

Metadata

Authors
Hu, K., & Zhang, Z.
Affiliations
  • University of Science and Technology of China (CN)
  • Chinese Academy of Sciences (CN)
ORCID
Venue
China Communications
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2016-12
Volume
13
Issue
12
Pages
189-198
ISSN
1673-5447 (ISSN-L)
DOI
10.1109/cc.2016.7897543
OpenAlex
W2607361454
Cited by
23
References
0
Citations by year
2026: 1 · 2025: 2 · 2024: 3 · 2023: 3 · 2022: 6 · 2021: 5 · 2020: 1 · 2019: 1 · 2017: 1
FWCI
0.63
Type
journal article
Language
en
Open access
closed
Locations
China Communications (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Signal Processing › Biometric Identification and Security
Keywords
web authentication, cryptographic protocol analysis, authentication attacks, user impersonation, security objectives

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review