Paper 2024/678

Quantum-Safe Account Recovery for WebAuthn

Douglas Stebila, University of Waterloo
Spencer Wilson, University of Waterloo

WebAuthn is a passwordless authentication protocol which allows users to authenticate to online services using public-key cryptography. Users prove their identity by signing a challenge with a private key, which is stored on a device such as a cell phone or a USB security token. This approach avoids many of the common security problems with password-based authentication. WebAuthn's reliance on proof-of-possession leads to a usability issue, however: a user who loses access to their authenticator device either loses access to their accounts or is required to fall back on a weaker authentication mechanism. To solve this problem, Yubico has proposed a protocol which allows a user to link two tokens in such a way that one (the primary authenticator) can generate public keys on behalf of the other (the backup authenticator). With this solution, users authenticate with a single token, only relying on their backup token if necessary for account recovery. However, Yubico's protocol relies on the hardness of the discrete logarithm problem for its security and hence is vulnerable to an attacker with a powerful enough quantum computer. We present a WebAuthn recovery protocol which can be instantiated with quantum-safe primitives. We also critique the security model used in previous analysis of Yubico's protocol and propose a new framework which we use to evaluate the security of both the group-based and the quantum-safe protocol. This leads us to uncover a weakness in Yubico's proposal which escaped detection in prior work but was revealed by our model. In our security analysis, we require the cryptographic primitives underlying the protocols to satisfy a number of novel security properties such as KEM unlinkability, which we formalize. We prove that well-known quantum-safe algorithms, including CRYSTALS-Kyber, satisfy the properties required for analysis of our quantum-safe protocol.

Note: May 9, 2024: revised sectioning, fixed typos

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. AsiaCCS 2024
account recoveryFIDO2post-quantumquantum-safeWebAuthn
Contact author(s)
dstebila @ uwaterloo ca
spencer wilson @ uwaterloo ca
2024-05-09: revised
2024-05-03: received
See all versions
Short URL
Creative Commons Attribution


      author = {Douglas Stebila and Spencer Wilson},
      title = {Quantum-Safe Account Recovery for {WebAuthn}},
      howpublished = {Cryptology ePrint Archive, Paper 2024/678},
      year = {2024},
      doi = {10.1145/3634737.3661138},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.