Formal verification of the W3C web authentication protocol

Abstract

The science of security can be set on rm foundations via the formal veri cation of protocols. New protocols can have their design validated in a mechanized manner for security aws, allowing protocol designs to be scienti cally compared in a neutral manner. Given that these techniques have discovered critical aws in protocols such as TLS 1.2 and are now being used to re-design protocols such as TLS 1.3, we demonstrate how formal veri cation can be used to analyze new protocols such as the W3C Web Authentication API. We model W3C Web Authentication with the formal veri cation language ProVerif, showing that the protocol itself is secure. However, we also stretch the boundaries of formal veri cation by trying to verify the privacy properties of W3C Web Authentication given in terms of the same origin policy. We use ProVerif to show that without further mandatory requirements in the specication, the claimed privacy properties do not hold. Next steps on how formal veri cation can be further integrated into standards and the further development of the privacy properties of W3C Web Authentication is outlined.

Authentication of IoT Device and IoT Server Using Security Key

“…In a study that was conducted by [11], the science behind the establishment of security systems could be established based on rm grounds of formal protocols of veri cation. There are new protocols that could have their designs being validated in a manner that is more mechanized to ensure that they are in sole positions of dealing with possible security aws [11].…”

“…In a study that was conducted by [11], the science behind the establishment of security systems could be established based on rm grounds of formal protocols of veri cation. There are new protocols that could have their designs being validated in a manner that is more mechanized to ensure that they are in sole positions of dealing with possible security aws [11]. One of the core risks that has been compromising the effectiveness of security of current information systems is the ability of different groups of users to create and subsequently utilize high-entropy passwords that are unique to speci c domains.…”

“…One of the core risks that has been compromising the effectiveness of security of current information systems is the ability of different groups of users to create and subsequently utilize high-entropy passwords that are unique to speci c domains. Even more, the whole idea of using passwords as what could be termed as a symmetric secret when it comes to authentication includes the need to replace those passwords with symmetric cryptography [11]. That is bearing in mind that security has for a long time now been perceived as a black art that is highly based on intuition as contrasted to science.…”

“…This task is not only challenging but also demanding. That is why formal authentication approaches have paved the way for tremendous progress when coming up with the right de nition for and varication fundamentals of security features [11]. Game-hopping proofs that have been formalized have placed cryptographic eld on what could be regarded as a sound basis and could function on complex protocols even though a lot is still to be done [11].…”

“…Methodologies that are relied upon by formal veri cation tools offer a very promising path when it comes to the veri cation of various security features including the privacy features of cryptographic protocols and primitives. The essence of formal veri cation includes the checking and establishment of different properties of cryptographic primitives and tools not through some of the proofs that have been created using hands, but via proofs that have been developed in a manner that has been mechanized fully [11]. It is equally vital to note that whereas testing could assist in assessing the security requirements of programs, there is a possibility of failing to test a particular aspect, thus paving the way for security loopholes [11].…”