0
$\begingroup$

I just created Webkey in the last couple days. This should allow any website to do single-password auth with a much higher level of auth security and convenience for users (single password with potentially hours or days expiry, text-entry-less single-click authentication if the password hasn't expired yet).

It uses RSA keys generated in-browser, stored in encrypted form using aes. The user's password is never sent over the internet (even in encrypted form). This utility can be hosted entirely statically (and is currently being hosted at http://webkey-auth.github.io/guest.html ).

Is what I'm doing here theoretically secure? I think this could be a huge improvement over auth based on sending usernames and password - which is kind of the weakest link in internet security at the moment. What are potential problems with how this works?

$\endgroup$
  • $\begingroup$ You may get better answers on security.se. First impression from me is that it seems to be an attempt to reinvent client certificates $\endgroup$ – Someone Somewhere Apr 5 '16 at 1:12
  • $\begingroup$ @SomeoneSomewhere Thanks for the tip, I'll try there. Yes indeed it is an attempt to reinvent client certificates - their UI badly needs to be reinvented. $\endgroup$ – B T Apr 5 '16 at 1:22
  • $\begingroup$ @BT Certificates are binary blobs containing a signature. They're not window components; they don't have an UI. $\endgroup$ – Maarten Bodewes Apr 5 '16 at 10:00
  • $\begingroup$ @MaartenBodewes There is obviously a UI for managing your certs and giving sites access to your public key. That's what I'm talking about. $\endgroup$ – B T Apr 5 '16 at 19:47
  • $\begingroup$ Page not found on the guest.html link... Did you mean or rename it to host.html? $\endgroup$ – Maarten Bodewes Apr 5 '16 at 20:29
2
$\begingroup$

First of all, you should make a more formal definition of the protocol. Security cannot be assessed without a proper definition.

Second you don't specify an key sizes. RSA-512 is such a low key size that it may be considered broken. On the other hand, you may run into performance issues if you choose a higher key size (Elliptic Curve crypto would make more sense). This is not theoretical security, I know, but it kind-of makes sure that this will never run for any practical key sizes.

The same for the challenge. 3 characters is way to low and almost begs for replay attacks if the same challenge is ever send. A 16 byte challenge should be the minimum.

You seem to be using a Node.js include for your RSA key pair code. That's strange if the key generation is offered within the browser as you suggest.

The biggest usability issue is the fact that you may loose your private key if the browser storage is destroyed. The RSA key seems to be local to the browser, so sharing different devices isn't specified.

It doesn't seem to be specified what happens if you loose your key.

I haven't seen any requirements for TLS (with server authentication). You'd need that otherwise an attacker may steal your key by simply injecting Java Script code.


All in all, there's too much missing from the description of your protocol to make a full security review. But it seems there is a lot that may need improvement before it can be used for any serious purposes.

$\endgroup$
  • $\begingroup$ About 512-bit, your answer here: crypto.stackexchange.com/questions/34229/… mentioned that lower key sizes may be acceptable for authentication where the signature is single use. In my case, I was hoping someone more knowledgeable about this than me could recommend a good rsa keys-size here. So if not 512, what would be reasonable? $\endgroup$ – B T Apr 5 '16 at 22:13
  • 1
    $\begingroup$ No quoting my answer back to me please :P But ok, as long as you time it you can get away with lower key sizes. You could prossibly factor the modulus if you keep using the key : not good. $\endgroup$ – Maarten Bodewes Apr 5 '16 at 22:14
  • $\begingroup$ Because I'm using webpack to package stuff together, I can use node.js-style requires. Also, I do specify what to do for identity recovery and multiple devices - its the same mechanism for both (and basically the same mechanism as password recovery in normal username/password cases). The application server send you an email which you can use to verify the new public key. $\endgroup$ – B T Apr 5 '16 at 22:16
  • $\begingroup$ I do mention that https is required in the readme somewhere.. but in any case, there's javascript code that throws an exception if the location isn't https - which would alert application developers using webkey that they need to fix that. $\endgroup$ – B T Apr 5 '16 at 22:17
  • $\begingroup$ I very much appreciate your advice. I'm not sure where to start with a more formal definition of the protocol, I've never written a security protocol before. How might I get started in that regard? $\endgroup$ – B T Apr 5 '16 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.