1.1k VIEWS
Pinterest LinkedIn LINE

As multi-factor authentication (MFA) has become increasingly widespread in recent years, balancing user convenience with security has become a challenge. MFA is a security method that prevents unauthorized account access by combining multiple authentication methods, such as passwords, biometrics, and one-time passwords. However, introducing MFA means adding cumbersome steps for users. A new authentication technology called a Syncable Authenticator, also known as a Passkey, has emerged to address this issue.

Syncable authenticators allow the private keys used for authentication to be synchronized across multiple devices, enabling users to use the same credentials on any device. This greatly improves convenience. On the other hand, sharing private keys across multiple devices entails security risks. The U.S. National Institute of Standards and Technology (NIST) has therefore published guidelines on the secure use of syncable authenticators (a supplement to SP 800-63B).

This document supplements NIST Special Publication 800-63B and provides guidance on using syncable authenticators, also known as passkeys, whose authentication keys can be copied and synchronized across devices. Its main points are as follows.

  1. Properly configured syncable authenticators can achieve Authentication Assurance Level 2 (AAL2) by mitigating threats such as man-in-the-middle attacks, verifier impersonation, and replay attacks, while providing authentication intent. AAL2 requires advanced security, including phishing resistance, while maintaining a degree of usability.
  2. The document updates SP 800-63B to permit the duplication of authentication keys for syncable authenticators, provided that certain requirements concerning key generation, storage, and access control are met. This enables government agencies to use passkeys as well.
  3. It discusses implementation considerations, such as using flags in the WebAuthn specification to determine whether an authenticator meets AAL2 requirements. For enterprise use cases, attestation can be used to verify an authenticator’s capabilities.
  4. It outlines potential threats and challenges involving syncable authenticators, including unauthorized key use, compromise of the synchronization fabric, and difficulties with revocation, and proposes ways to mitigate them.
  5. The document acknowledges the risk of key sharing between users in some implementations and provides guidance for enterprise and public-facing use cases.

Overall, this supplement is intended to help agencies make informed, risk-based decisions about integrating syncable authenticators, which can provide convenient, phishing-resistant authentication when properly deployed.

This supplement provides important criteria for evaluating the suitability of syncable authenticators for AAL2. It also addresses emerging threats such as unauthorized use of keys and compromise of cloud storage, and recommends countermeasures. While recognizing the potential risks of syncable authenticators, it shows that proper deployment can improve security without sacrificing convenience.

This supplement provides useful information not only for security personnel but for everyone considering the introduction of syncable authenticators. The existence of official NIST guidance should increase confidence in their security and encourage adoption. Growth in the number of users will promote further technological innovation. This supplement is likely to become an important milestone contributing to the sound development of new authentication technology that combines security and convenience.

For more details on the background, see this article by @phr_eidentity1.

Footnotes

  1. Takashi Fuchie, A Supplement on Syncable Authenticators for NIST SP 800-63B Has Been Released https://idmlab.eidentity.jp/2024/04/nist-sp800-63b.html?m=1

Related posts