Will I be able to (ab)use a FIDO U2F compliant hardware token to decrypt data?

Question

I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser.

However, so far all my efforts to obtaining a physical hardware token supporting the FIDO U2F specs for testing were without success.

What I would be particularly interested in, is decrypting short messages with the app_id specific private key stored in the device through a JavaScript call.

While the "FIDO U2F" Javascript API draft doesn't mention a method for this, I wonder whether I could use a simple sign request and simply provide the data to be decrypted as websafe-base64-encoded challenge? In my understanding, the response returned from the device would be the decrypted challenge.

Am I correct with this or do I misunderstand the way challenge/response is implemented here?

Answer 1

No, you will not be ble to abuse challenges in that way. You may be thinking about e.g. raw RSA, where signing and decryption are mathematically similar. However, this is not possible in FIDO U2F:

• All the defined signature algorithms use SHA256 on the signed data, meaning that you'd have to brute force search for something that produces the correct signature.
• Not all the hashed/signed data is controlled or even necessarily known by the server. E.g. the signer has an incrementing counter that's part of the signed data.