This is part 1 of a series on cryptographic authentication. Part 2 and Part 3 are now available.
FIDO adoption lags in spite of general availability
In a white paper issued in March 2022 the FIDO Alliance candidly announced that FIDO-based authentication based on the FIDO2 standards, which include the Client-To-Authenticator Protocol of the FIDO Alliance and the companion Web Authentication API (WebAuthn) of the W3C “has not attained large-scale adoption in the consumer space”.
FIDO2 is a cryptographic authentication solution for the web, which uses a key pair managed by an authenticator and is advertised by the FIDO Alliance as being “passwordless”. The key pair may be stored in the authenticator, or, equivalently from a security viewpoint, it may be encrypted under a symmetric key stored in the authenticator, and exported to play the role of a “credential ID”. The authenticator may be a “roaming authenticator” carried in a “security key”, or a “platform authenticator” provided by the OS of the user's smartphone or laptop.
Early authenticators were security keys, which few web users had. Today most smartphones and laptops have platform authenticators, and that makes FIDO2 a generally available web technology. But the announcement by the FIDO Alliance shows that general availability has not translated into general adoption.
The white paper attributes this to challenges that consumers face with platform authenticators: “having to re-enroll each new device”, and having “no easy ways to recover from a lost or stolen device” as the credentials managed by the platform authenticator of the device are lost. To address the loss-of-credential problem, Apple, Google and Microsoft have announced a joint effort to devise solutions that are expected to become available “in the course of the coming year” and that, according to the white paper, will involve “multi-device credentials”.
Another contributing factor to the lack of adoption, however, is no doubt the complexity and cost of the FIDO2 authentication solution. Implementing the solution in a web app requires FIDO Server software provided by a company certified to provide such software by the FIDO Alliance. A team from the certified company must work with a team from the company that is developing the app to integrate the solution into the app. By contrast, an ordinary 2FA solution is implemented by the app developers themselves, possibly by a single developer, without any integration effort.
Thus FIDO faces two obstacles to widespread adoption: usability and cost.
Two working demonstrations of cryptographic authentication on GitHub
But cryptographic authentication need not be complicated, costly
or challenging to the consumer. It can be implemented simply by
storing a key pair in persistent browser storage (localStorage or
IndexDB), registering the public key, and authenticating by proof of
possession of the private key. I will refer to this as the browser
storage solution to cryptographic authentication while referring
to the use of a FIDO authenticator as the FIDO solution, or
the authenticator storage solution, glossing over the fact that
the private key may be exported under encryption rather than
physically kept in the authenticator.
The browser storage solution can easily overcome the two obstacles
that FIDO faces in the consumer space. To demonstrate this I have
published on GitHub two demo web apps that implement passwordless,
phishing-resistant cryptographic authentication with a key pair
credential, without relying on an authenticator. In both of them
the key pair is generated in the browser by the JavaScript frontend
of the app, and kept in the localStorage facility
provided by the
Web Storage
API. One
of them uses a “nosql” (MongoDB) backend database to
register the public key and store the user data,
while the
other uses an “sql” database for that purpose.