6
$\begingroup$

I understand that this might be more a process question:

Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device to generate an encryption key?

I would like to understand if U2F could be used to improve the following scenario:

  • I use a password manager with a password vault file with 100 stored passwords.
  • I use a master secret to unlock the password vault, which leads the password manager to decrypt all 100 passwords.
  • I use a single password from the vault to log into a web-site and close the vault again.
  • An attacker that has access to my computer would have access to the master password, the password vault file and all 100 passwords.

How can we improve on this scenario:

  • I would like to encrypt each password stored in the vault with a specific encryption key.
  • I would like to use a second factor device to make sure that only one password is decrypted at a time when I perform a physical action.
  • U2F seems an ideal application for this, since it automates the process of storing individual credentials for individual 'sites', except that it performs signatures but not encryption.

Constraints:

  • The public/private key pair is generated inside the U2F device and the private key can not leave the device.
  • The device does not support any other operations but the signature operations based on the U2F specification, namely ECDSA.
  • The password vault should be treated as an insecure and static, i.e. the user has unlocked the vault and an attacker could see all data in it. The password manager has no means to perform any secret operation, any computation is visible to an attacker.
  • Communication between password manager and U2F device can be observed entirely by the attacker.

Pointers:

To answer @fgrieu's question:

  • The U2F device is meant to assist to decrypt a single encrypted password
  • An authentication scheme is not sufficient, since an attacker has access to all encrypted data and could bypass the authentication step if no encryption is involved.
  • Only a signature function exists on the U2F device
  • The U2F protocol is executed by the password manager as the server, so no external data storage exists. All U2F handle information and the ECDSA public-key are to be stored in the password vault.
  • The U2F device generates public/private key-pairs of which the public-key is returned as part of the initial registration. The private key remains securely stored on the U2F device.
Improve this question
$\endgroup$
11
  • $\begingroup$ U2F by itself is an authentication protocol, if you have direct access to the primitives required for the protocol things may be possible though. $\endgroup$
    – SEJPM
    Mar 14, 2017 at 20:20
  • 3
    $\begingroup$ The question is assuming that I have a U2F device that I could interact with in any way the U2F specification says the device must be capable of. $\endgroup$
    – Christopher Oezbek
    Mar 14, 2017 at 20:23
  • $\begingroup$ Are you asking whether it is possible to use U2F's ECDSA (see here) signature of some piece of data as an encryption key? $\endgroup$
    – rodentrabies
    Mar 15, 2017 at 2:07
  • $\begingroup$ @mrwhythat Yes, that would be the question. Can we design an encryption protocol around such as a signature. $\endgroup$
    – Christopher Oezbek
    Mar 15, 2017 at 19:21
  • 1
    $\begingroup$ Yes, usage of the device before an attacker gets hold of the database should not lead to any loss of passwords. Yes, the device would be necessary to enter a new password into the vault (encrypt it). Yes, symmetric encryption would be enough. Sum up: Can we derive a encryption key (any) from an ECDSA scheme? $\endgroup$
    – Christopher Oezbek
    Mar 19, 2017 at 16:01

1 Answer 1

Reset to default
3
$\begingroup$

No.

It is possible to derive keys from deterministic signatures (or non-deterministic signatures that can be converted into a deterministic value), for example Android uses Trusted Execution Environment's RSA signing plus scrypt to bind Full Disk Encryption keys to a specific device.

However, ECDSA signatures are not deterministic (there's RFC6979, which specifies deterministic use, but U2F doesn't use it), so each generated signature will be different for the same message and key, thus you cannot derive the same key from multiple signings.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ I find the conclusion very plausible. However the "thus" lacks mathematical rigor. An hypothetical textbook-RSA-signing-like black box that accepts $m$ with $0<m<N$, and outputs $(r,s)$ with random $r$ ($0<r<N$ and $\gcd(r,N)=1$) and $s=x^d\;r\bmod N$ (perhaps computed as $s=(r^e\;x)^d\bmod N$ internally) generates different signatures for the same message and key, yet can be efficiently turned into a deterministic RSA deciphering device with a little external code. $\endgroup$
    – fgrieu ♦
    May 29, 2017 at 15:57
  • $\begingroup$ @fgrieu: If it can be turned into a deterministic RSA device, wouldn't it be possible to use it for the intended purpose? $\endgroup$
    – Christopher Oezbek
    May 29, 2017 at 17:51
  • $\begingroup$ @Christopher Oezbek: that's my point. A deciphering device is just what the question asks, and the reasoning in the answer does not satisfactorily demonstrate that the U2F device can't be transformed into that with some clever math. Still, I'm also inclined to believe that it can't be done. $\endgroup$
    – fgrieu ♦
    May 29, 2017 at 18:42
  • 1
    $\begingroup$ I think this article disagrees with your conclusion: jbp.io/2015/11/23/abusing-u2f-to-store-keys.html However, I am not competent enough to understand if the described method is sound or not $\endgroup$
    – joonas.fi
    Nov 20, 2018 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.