I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser.

However, so far all my efforts to obtaining a physical hardware token supporting the FIDO U2F specs for testing were without success.

What I would be particularly interested in, is decrypting short messages with the app_id specific private key stored in the device through a JavaScript call.

While the "FIDO U2F" Javascript API draft doesn't mention a method for this, I wonder whether I could use a simple sign request and simply provide the data to be decrypted as websafe-base64-encoded challenge? In my understanding, the response returned from the device would be the decrypted challenge.

Am I correct with this or do I misunderstand the way challenge/response is implemented here?


1 Answer 1


No, you will not be ble to abuse challenges in that way. You may be thinking about e.g. raw RSA, where signing and decryption are mathematically similar. However, this is not possible in FIDO U2F:

  • All the defined signature algorithms use SHA256 on the signed data, meaning that you'd have to brute force search for something that produces the correct signature.
  • Not all the hashed/signed data is controlled or even necessarily known by the server. E.g. the signer has an incrementing counter that's part of the signed data.
  • $\begingroup$ Thank you for your answer! Do you see any other way to use a U2F compliant token for decryption? $\endgroup$
    – mritz_p
    Commented Sep 14, 2014 at 12:21
  • $\begingroup$ @mritz_p, no, I don't think it's possible, but I haven't looked at it in enough detail to be certain. $\endgroup$
    – otus
    Commented Sep 14, 2014 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.