{"id":"https://openalex.org/W4385692020","doi":"https://doi.org/10.1145/3600160.3600174","title":"Rogue key and impersonation attacks on FIDO2: From theory to practice","display_name":"Rogue key and impersonation attacks on FIDO2: From theory to practice","publication_year":2023,"publication_date":"2023-08-09","ids":{"openalex":"https://openalex.org/W4385692020","doi":"https://doi.org/10.1145/3600160.3600174"},"language":"en","primary_location":{"id":"doi:10.1145/3600160.3600174","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3600174","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3600174","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3600174","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5065970435","display_name":"Manuel Barbosa","orcid":"https://orcid.org/0000-0002-6848-5564"},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]},{"id":"https://openalex.org/I4210166615","display_name":"INESC TEC","ror":"https://ror.org/05fa8ka61","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I4210125590","https://openalex.org/I4210166615"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Manuel Barbosa","raw_affiliation_strings":["Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal"],"raw_orcid":"https://orcid.org/0000-0002-6848-5564","affiliations":[{"raw_affiliation_string":"Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal","institution_ids":["https://openalex.org/I182534213","https://openalex.org/I4210166615"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064807337","display_name":"Andr\u00e9 Cirne","orcid":"https://orcid.org/0000-0002-3433-9809"},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]},{"id":"https://openalex.org/I4210166615","display_name":"INESC TEC","ror":"https://ror.org/05fa8ka61","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I4210125590","https://openalex.org/I4210166615"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Andr\u00e9 Cirne","raw_affiliation_strings":["Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal"],"raw_orcid":"https://orcid.org/0000-0002-3433-9809","affiliations":[{"raw_affiliation_string":"Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal","institution_ids":["https://openalex.org/I182534213","https://openalex.org/I4210166615"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5092794603","display_name":"Lu\u00eds Esqu\u00edvel","orcid":"https://orcid.org/0009-0009-6387-9271"},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]},{"id":"https://openalex.org/I4210166615","display_name":"INESC TEC","ror":"https://ror.org/05fa8ka61","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I4210125590","https://openalex.org/I4210166615"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Lu\u00eds Esqu\u00edvel","raw_affiliation_strings":["Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal"],"raw_orcid":"https://orcid.org/0009-0009-6387-9271","affiliations":[{"raw_affiliation_string":"Departamento de Ci\u00eancia de Computadores, Faculdade de Ci\u00eancias, Universidade do Porto, rua do Campo Alegre s/n, 4169-007 Porto, Portugal and INESC TEC, Porto, Portugal, Portugal","institution_ids":["https://openalex.org/I182534213","https://openalex.org/I4210166615"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8724,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.87546528,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"11"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11504","display_name":"Advanced Authentication Protocols Security","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.77381432056427},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.746610164642334},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7405791282653809},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.5810795426368713},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5470316410064697},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5309808850288391},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.4519384801387787},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.4488074779510498},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.19654926657676697}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.77381432056427},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.746610164642334},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7405791282653809},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.5810795426368713},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5470316410064697},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5309808850288391},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.4519384801387787},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.4488074779510498},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.19654926657676697}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3600160.3600174","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3600174","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3600174","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3600160.3600174","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3600174","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3600174","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6000000238418579,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1578237752","display_name":null,"funder_award_id":"COMPETE","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G3591346772","display_name":null,"funder_award_id":"2021.08587","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G3838636553","display_name":null,"funder_award_id":"-01-0247-","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G3891694003","display_name":null,"funder_award_id":"COMPETE_2020","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G4098484372","display_name":null,"funder_award_id":"POCI-01-0247-FEDER-047264","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G5224927334","display_name":null,"funder_award_id":"POCI-01-","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G6126344035","display_name":null,"funder_award_id":"POCI-01\u20130247","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"}],"funders":[{"id":"https://openalex.org/F4320334779","display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia","ror":"https://ror.org/00snfqn58"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385692020.pdf","grobid_xml":"https://content.openalex.org/works/W4385692020.grobid-xml"},"referenced_works_count":5,"referenced_works":["https://openalex.org/W2311411768","https://openalex.org/W2588425636","https://openalex.org/W3037285711","https://openalex.org/W4384948711","https://openalex.org/W6922120124"],"related_works":["https://openalex.org/W2770234245","https://openalex.org/W96612179","https://openalex.org/W4229499248","https://openalex.org/W2566006169","https://openalex.org/W1567818861","https://openalex.org/W2987774938","https://openalex.org/W4256492088","https://openalex.org/W632915154","https://openalex.org/W2137529864","https://openalex.org/W2083912792"],"abstract_inverted_index":{"FIDO2":[0,10,53,68,124],"is":[1],"becoming":[2],"a":[3,33,116],"defacto":[4],"standard":[5],"for":[6],"passwordless":[7],"authentication.":[8],"Using":[9],"and":[11,25,70,110,122],"WebAuthn,":[12],"web":[13],"applications":[14],"can":[15],"enable":[16],"users":[17],"to":[18,22,41,93,102,139],"associate":[19],"cryptographic":[20],"credentials":[21],"their":[23,48],"profiles,":[24],"then":[26],"rely":[27],"on":[28],"an":[29],"external":[30],"authenticator":[31],"(e.g.,":[32],"hardware":[34],"token":[35],"plugged":[36],"into":[37],"the":[38,62,67,97,128,140,146],"USB":[39],"port)":[40],"perform":[42],"strong":[43],"signature-based":[44],"authentication":[45],"when":[46],"accessing":[47],"accounts.":[49],"The":[50],"security":[51],"of":[52,79,88,131,142,145],"has":[54],"been":[55],"theoretically":[56],"validated,":[57],"but":[58],"these":[59,89],"analyses":[60],"follow":[61],"threat":[63],"model":[64],"adopted":[65],"in":[66,96,104],"design":[69],"explicitly":[71],"exclude":[72],"some":[73],"attack":[74],"vectors":[75],"as":[76],"being":[77],"out":[78],"scope.":[80],"In":[81],"this":[82],"paper":[83],"we":[84,135],"show":[85],"that":[86],"two":[87],"attacks,":[90],"which":[91,134],"appear":[92],"be":[94],"folklore":[95],"community,":[98],"are":[99],"actually":[100],"straightforward":[101],"launch":[103],"practice":[105],"(user":[106],"PIN":[107],"extraction,":[108],"impersonation":[109],"rogue":[111],"key":[112],"registration).":[113],"We":[114,126],"demonstrate":[115],"deployment":[117],"over":[118],"vanilla":[119],"Linux":[120],"distributions":[121],"commercial":[123],"authenticators.":[125],"discuss":[127],"potential":[129],"impact":[130],"our":[132],"results,":[133],"believe":[136],"will":[137],"contribute":[138],"improvement":[141],"future":[143],"versions":[144],"protocol.":[147]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}