An Analysis of Attack Vectors Against FIDO2 Authentication

• URL: http://arxiv.org/abs/2604.20826v1
• Date: Wed, 22 Apr 2026 17:52:56 GMT
• Title: An Analysis of Attack Vectors Against FIDO2 Authentication
• Abstract summary: This paper examines passkeys, also known as FIDO2, which claim to provide phishing-resistant authentication.<n>A private key is stored on a user's device, the authenticator, while the server stores the corresponding public key.<n>During authentication, the server generates a challenge that the user signs with the private key; the server then verifies the signature and establishes a session.
• Score: 45.88028371034407
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Phishing attacks remain one of the most prevalent threats to online security, with the Anti-Phishing Working Group reporting over 890,000 attacks in Q3 2025 alone. Traditional password-based authentication is particularly vulnerable to such attacks, prompting the development of more secure alternatives. This paper examines passkeys, also known as FIDO2, which claim to provide phishing-resistant authentication through asymmetric cryptography. In this approach, a private key is stored on a user's device, the authenticator, while the server stores the corresponding public key. During authentication, the server generates a challenge that the user signs with the private key; the server then verifies the signature and establishes a session. We present passkey workflows and review state-of-the-art attack vectors from related work alongside newly identified approaches. Two attacks are implemented and evaluated: the Infected Authenticator attack, which generates attacker-known keys on a corrupted authenticator, and the Authenticator Deception attack, which spoofs a target website by modifying the browser's certificate authority store, installing a valid certificate, and intercepting user traffic. An attacker relays a legitimate challenge from the real server to a user, who signs it, allowing the attacker to authenticate as the victim. Our results demonstrate that successful attacks on passkeys require substantial effort and resources. The claim that passkeys are phishing-resistant largely holds true, significantly raising the bar compared to traditional password-based authentication.

Related papers

• Beyond the Trust Boundary: A Critical Reassessment of the FIDO2 Threat Model [0.1499944454332829]
  We show that FIDO2 depends on environmental assumptions that may not hold in practice.<n>Attack chains spanning multiple layers can bypass the intended security guarantees of FIDO2.<n> effective FIDO2 security requires layered mitigations covering the browser, operating system, hardware, protocol stack, and metadata infrastructure.
  arXiv  Detail & Related papers  (2026-09-03T13:00:19Z)
• SSHafe: A Real-Time SSH Brute Force Attack Detection and Novel Credential Rotation Standard [0.0]
  SSH is a critical yet heavily targeted protocol for remote system administration.<n>Password-based authentication exposes servers to large-scale brute-force, dictionary, and credential-spray attacks.<n>This work presents SSHafe, a real-time SSH brute-force detection and mitigation system.
  arXiv  Detail & Related papers  (2026-08-10T03:13:41Z)
• Reverse Online Guessing Attacks on PAKE Protocols [0.43748379918040853]
  We show that password-authenticated key exchange protocols are vulnerable to reverse online guessing attacks.<n> reverse guessing poses a unique risk because the burden of detection is shifted to the clients.<n>Our analysis suggests that stakeholders should, by default, authenticate the server using more stringent measures than just the user's password.
  arXiv  Detail & Related papers  (2026-02-09T18:40:53Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• Device-Bound vs. Synced Credentials: A Comparative Evaluation of Passkey Authentication [0.0]
  With passkeys, the FIDO Alliance introduces the ability to sync FIDO2 credentials across a user's devices through passkey providers.<n>This aims to mitigate user concerns about losing their devices and promotes the shift toward password-less authentication.<n>We show how credential syncing has also created a debate among experts about their security guarantees.
  arXiv  Detail & Related papers  (2025-01-13T15:00:18Z)
• CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2 [2.949446809950691]
  We focus on CTAP, which allows FIDO2 clients and hardware authenticators to communicate.<n>We uncover two classes of protocol-level attacks on CTAP that we call CTRAPS.<n>We detail the eight vulnerabilities in the CTAP specification, enabling the CTRAPS attacks.<n>We release CTRAPS, an original toolkit, to analyze CTAP and conduct the CTRAPS attacks.
  arXiv  Detail & Related papers  (2024-12-03T10:11:41Z)
• Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective [53.24281798458074]
  Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning)
  arXiv  Detail & Related papers  (2024-05-21T13:34:23Z)
• A Novel Protocol Using Captive Portals for FIDO2 Network Authentication [45.84205238554709]
  We introduce FIDO2CAP: FIDO2 Captive-portal Authentication Protocol. We develop a prototype of FIDO2CAP authentication in a mock scenario. This work makes the first systematic approach for adapting network authentication to the new authentication paradigm relying on FIDO2 authentication.
  arXiv  Detail & Related papers  (2024-02-20T09:55:20Z)
• Reducing Usefulness of Stolen Credentials in SSO Contexts [0.0]
  Multi-factor authentication (MFA) helps to thwart attacks that use valid credentials, but attackers still commonly breach systems by tricking users into accepting MFA step up requests. This paper proposes a token-based enrollment architecture that is less invasive to user devices than mobile device management.
  arXiv  Detail & Related papers  (2024-01-21T21:05:32Z)
• Conditional Generative Adversarial Network for keystroke presentation attack [0.0]
  We propose to study a new approach aiming to deploy a presentation attack towards a keystroke authentication system. Our idea is to use Conditional Generative Adversarial Networks (cGAN) for generating synthetic keystroke data that can be used for impersonating an authorized user. Results indicate that the cGAN can effectively generate keystroke dynamics patterns that can be used for deceiving keystroke authentication systems.
  arXiv  Detail & Related papers  (2022-12-16T12:45:16Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)
• Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them [91.3755431537592]
  Phishing attacks have become the most used technique in the online scams, initiating more than 91% of cyberattacks, from 2012 onwards. This study reviews how Phishing and Spear Phishing attacks are carried out by the phishers, through 5 steps which magnify the outcome.
  arXiv  Detail & Related papers  (2020-05-31T18:10:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.