Paper 2022/084

Token meets Wallet: Formalizing Privacy and Revocation for FIDO2

Lucjan Hanzlik, Julian Loss, and Benedikt Wagner


The FIDO2 standard is widely-used class of challenge-response type protocols that allows to authenticate to an online service using a hardware token. Barbosa et al. (CRYPTO `21) provided the first formal security model and analysis for the FIDO2 standard. However, their model has two shortcomings: (1) it does not include privacy, one of the key features claimed by FIDO2 (2) their model and proofs apply only to tokens that store all secret keys locally. In contrast, due to limited memory, most existing FIDO2 tokens use one of the following approaches to handle an unlimited number of keys. Key derivation derives a fresh per-server secret key from a common seed. Key wrapping stores an encryption of the key on the server and retrieves them for each authentication. These approaches substantially complicate the protocols and their security analysis. In particular, they bear additional risks for privacy and security of FIDO2 that are not captured in the model Barbosa et al. model. In this paper, we revisit the security of the FIDO2 as implemented in practice. Our contributions are as follows. (1) We adapt the model of Barbosa et al. so as to capture authentication tokens using key derivation or key wrapping. (2) In our adapted model, we provide the first formal definition of privacy for FIDO2 and show that these common FIDO2 token implementations are secure in our model, if the underlying building blocks are chosen appropriately. (3) Finally, we address the unsolved problem of global key revocation in FIDO2. We first provide appropriate syntax of a revocation procedure and extend our model to support this feature. We then provide the first secure global key revocation protocol for FIDO2. Our solution is based on the popular BIP32 standard used in cryptocurrency wallets.

Available format(s)
Cryptographic protocols
Publication info
Preprint. Minor revision.
Contact author(s)
hanzlik @ cispa de
loss @ cispa de
benedikt wagner @ cispa de
2022-01-23: received
Short URL
Creative Commons Attribution


      author = {Lucjan Hanzlik and Julian Loss and Benedikt Wagner},
      title = {Token meets Wallet: Formalizing Privacy and Revocation for FIDO2},
      howpublished = {Cryptology ePrint Archive, Paper 2022/084},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.