Authenticator Key Pair Regeneration for Low-Storage User Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems, such as FIDO2, face limitations due to storage constraints on hardware tokens, which can only hold a limited number of key-pairs, and external credential storage increases vulnerability to attacks.
Innovation Solution
Generate key pairs on the fly using a deterministic process based on a secret key stored on the authenticator and relying party information, eliminating the need to store multiple key pairs on the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple key pairs are stored on the authenticator to support multiple relying parties, then the number of supported credentials increases, but the storage capacity of the authenticator is exceeded
Solution Approach 1:
The credential data is segmented into two parts: a small secret key stored on the authenticator and larger key pair data stored externally on the host system. This segmentation allows the authenticator to maintain minimal storage while supporting multiple credentials through deterministic generation of key pairs from the secret key and relying party identifiers.
Solution Approach 2:
The solution moves from storing complete key pairs in one dimension (authenticator storage) to a two-dimensional approach where the secret key resides on the authenticator and the generated key pairs are used temporarily during authentication operations, then discarded. This dimensional shift resolves the storage conflict.
2Adaptability or versatility
If credentials are encrypted and stored externally to increase storage capacity, then more credentials can be stored, but the vulnerability to attacks increases due to private key transmission
Solution Approach 1:
The private key is extracted from persistent storage and instead generated deterministically only when needed for authentication. This extraction eliminates the need to store private keys externally, removing the security vulnerability associated with external credential storage while still enabling support for multiple credentials through the secret key + relying party identifier combination.
Solution Approach 2:
The key pairs are treated as disposable, short-living objects that are generated on-demand, used for authentication, and then discarded. This approach eliminates the need for long-term external storage of sensitive credential data, thereby reducing vulnerability to attacks while maintaining adaptability to support multiple relying parties.
3Quantity of substance
If a secret key is stored on the authenticator for deterministic key pair generation, then storage requirements are reduced, but the processing capability requirement increases
Solution Approach 1:
The solution replaces the mechanical approach of storing complete key pairs with a computational approach using deterministic key pair generation from a secret key and relying party identifiers. This substitution reduces storage requirements while the processing complexity is managed by leveraging cryptographic algorithms that can be efficiently implemented on constrained devices.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method of registering or authenticating a user with a relying party is provided, the method including the steps of: receiving a request to generate a key pair, the request including key-generation data, the key-generation data including relying party information; deterministically generating, based on at least the key-generation data and a secret key stored in a memory of the authenticator, a key pair comprising a public key and a private key; either: transmitting the public key, or performing further processing using the private key; and deleting the key pair. An authenticator configured to perform the process is also provided.