In an earlier post, I discussed how Passkeys were single factor and why that was mostly okay. Today, I want to go over the other side of this in more detail - what happens when you have stronger requirements around the Passkeys that can be used in your environment, and how you can assess devices for trustworthiness?
TL;DR
If you want the "easy-path" answer, where myself and the Kanidm + Webauthn-RS developers have already performed the assessment for you:
- Yubikeys are the gold standard - nothing else compares.
- You must enforce attestation in your IDP, limited to the AAGUIDs of your selected devices.
- Check your IDP and attempt to enrol a device which is not a yubikey, and ensure it is rejected.
What Is The Process?
The security key needs to be assessed - there are two major categories.
- Assess the physical security and ease of use of the device.
- Assess the technical security of the device, including vendor responses.
NOTE: FIDO have their own certifications. For a similar level of validation to this checklist, you need to use FIDO L2 or higher devices.
Then you need to assess your IDP is capable of supporting your chosen devices.
- Assess that your IDP for support and policy enforcement
Physical Security
Security keys being a physical item have to go through distribution processes that software implementations do not have to. This includes manufacturing, distribution, and being present with the user in the world. Because of this the physical security of the device is very important to establish trust.
Checklist:
- Does the vendor document their manufacturing and security processes?
- Is the device shipped in tamper evident packaging?
- Is the device itself tamper proof?
- Can the device withstand physical use?
- Is the device easy to interact with physically? (e.g. the interaction button works everytime it is pressed)
Technical Security
The cryptographic and software elements of the device are just as important as the physical ones. Since the device will be inside a machine that may itself end up compromised, or the device may be stolen then it must be able to withstand software attacks as well.
Checklist:
- Does the device use a secure enclave for cryptographic key storage?
- Has the vendor's firmware been hardened against software attacks?
- Are there known software attacks against the device?
- Does the vendor have a positive track record of responding to security issues?
IDP Assessment
Webauthn (Passkeys) is a Trust-On-First-Use (TOFU) system. This means that the user will enrol the device without a centralised provisioning step. Because of this, your IDP needs to be capable of enforcing that only your selected devices can be enroled. This validation process is called "attestation" and relies on devices having a vendor cryptographic root of trust embeded during manufacturing that can not be tampered with.
- The IDP allows attestation of enroled Passkeys/FIDO2 devices.
- Attestation can be limited to specific device AAGUIDs and/or manufacturer certificate authorities.
- The IDP will reject non-conforming devices (e.g. a device with an incorrect AAGUID or signed by an alternate CA). It is CRITICAL you test this step, as we have found IDPs that even with an AAGUID filter list, still allow all devices to enrol.
HINT: Most manufactures will publish their AAGUIDs, such as Yubico. Alternately you can search the FIDO MDS to find device AAGUIDs.
Conclusion
Following this checklist will then let you assess your devices, build trust in them, and ensure that only the approved security keys are used with your IDP in your environment.