webauthn-secret

repurposing webauthn for end-to-end-encryption and peer-to-peer digital signatures!

an in-browser, webauthn version of https://jbp.io/2015/11/23/abusing-u2f-to-store-keys.html

enables creating and retrieving an opaque secret string from a hardware authenticator (optionally protected by an additional password).

depends on elliptic for key recovery (=> no guaranteed timing attacks safety)

DISCLAIMER: i'm no security expert

probably more secure than:

hand-typed passwords
browser-filled passwords (which are ultimately accessible from the file system)
storing plain text keys in the file system (e.g. signal desktop)
storing the material to derive keys from a password in the file system (e.g. metamask)
storing stuff on a server which can be accessed by any of these mechanisms

less secure than:

webauthn as it was intended, if the server itself can only ever be remotely accessed by a webauthn-like mechanism (e.g. ssh with a fido2 key), and you unconditionally trust the people who operate the server

the attack vector that this doesn't prevent, but proper webauthn does, is that a user's device is controlled by an attacker during key usage, and a side channel attack is run against the in-browser key recovery.

but note that a fully attacker-controlled user device offers another attack during key usage which no auth mechanism (not even proper webauthn) can prevent: modifying the user's browser/DNS to display a phishing website instead of the website normally asking for authentication, while disabling any browser-enforced counter-measures like preventing access to webauthn from a different origin.

usage

see demo.html for the API

TODO: i haven't made this an npm module yet. you can, however, use it in deno or a browser <script type="module"> by importing it directly from github through jsdelivr

import {
  createSecret,
  getSecret,
} from "https://cdn.jsdelivr.net/gh/mitschabaude/webauthn-secret/dist/webauthn-secret.min.js";

try it out

prerequisite: a fido2 authenticator (examples: yubikey, another usb key or android phone)

npx serve this folder
navigate to http://localhost:5000/demo.html
look at the console while you press the buttons

thanks

to the creators of indutny/elliptic, paroga/cbor-js and cryptocoinjs/base-x, on which this package depends