Understanding Universal 2nd Factor (U2F) Authentication

What is Universal 2nd Factor (U2F)?

• 💡 U2F is an open standard for hardware authentication tokens that enhance security in two-factor authentication.
• 🔑 These tokens use USB, NFC, or Bluetooth to communicate a crucial factor in the authentication process.

Evolution of Authentication Methods

• 🔒 The concept of passwords for computer access was introduced in the 1960s by Dr. Fernando Corbau as a temporary solution.
• 🔐 Two-factor authentication was patented in 1995 by AT&T, requiring at least two of three factors: something you have, something you are, or something you know.
• 🚀 The FIDO Alliance was formed in 2012 with the goal of developing passwordless authentication protocols.
• 🤝 By 2013, Google, Ubico, and NXP joined the alliance, contributing the idea of an open-source second-factor authentication protocol.

U2F Technology and Functionality

• 📱 In 2015, the alliance announced support for contactless transport over Bluetooth and NFC, enabling wireless communication between devices.
• 📍 NFC allows devices to communicate wirelessly when placed close together, with a range of about 4 inches.
• 🛠️ U2F provides a universal standard for creating physical authentication tokens compatible with any service.
• 🛒 As of 2022, vendors like Google, Ubico, Thetus, and Kensington offer U2F tokens that use NFC, Bluetooth, or USB for web transaction authentication.

How U2F Keys Work Under the Hood

• 🔒 The evidence exchanged between the user and the device (like a PIN or biometric) is local, removing vulnerabilities of remote attacks.
• 🔑 The authenticator device signs challenges using a private key generated on the device itself.
• ☁️ The public key is stored with the username in a cloud database.
• ✅ The application (relying party) verifies the signature to confirm the correct device and user, ensuring the authenticator performed its job correctly.