I understand that this might be more a process question:
Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device to generate an encryption key?
I would like to understand if U2F could be used to improve the following scenario:
- I use a password manager with a password vault file with 100 stored passwords.
- I use a master secret to unlock the password vault, which leads the password manager to decrypt all 100 passwords.
- I use a single password from the vault to log into a web-site and close the vault again.
- An attacker that has access to my computer would have access to the master password, the password vault file and all 100 passwords.
How can we improve on this scenario:
- I would like to encrypt each password stored in the vault with a specific encryption key.
- I would like to use a second factor device to make sure that only one password is decrypted at a time when I perform a physical action.
- U2F seems an ideal application for this, since it automates the process of storing individual credentials for individual 'sites', except that it performs signatures but not encryption.
Constraints:
- The public/private key pair is generated inside the U2F device and the private key can not leave the device.
- The device does not support any other operations but the signature operations based on the U2F specification, namely ECDSA.
- The password vault should be treated as an insecure and static, i.e. the user has unlocked the vault and an attacker could see all data in it. The password manager has no means to perform any secret operation, any computation is visible to an attacker.
- Communication between password manager and U2F device can be observed entirely by the attacker.
Pointers:
- A comment in an answer to a similar question on security.stackexchange.com seems to indicate that there is no plausible way to use an ECDSA device to derive an encryption scheme
To answer @fgrieu's question:
- The U2F device is meant to assist to decrypt a single encrypted password
- An authentication scheme is not sufficient, since an attacker has access to all encrypted data and could bypass the authentication step if no encryption is involved.
- Only a signature function exists on the U2F device
- The U2F protocol is executed by the password manager as the server, so no external data storage exists. All U2F handle information and the ECDSA public-key are to be stored in the password vault.
- The U2F device generates public/private key-pairs of which the public-key is returned as part of the initial registration. The private key remains securely stored on the U2F device.