Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Qey: Implementation and performance study of post quantum cryptography in FIDO2

Aditya Mitra, Sibi Chakkaravarthy Sethuraman

TL;DR

This work addresses the quantum security gap in FIDO2 by implementing a post-quantum signature scheme ML-DSA (Crystals-Dilithium) within a new security key called The Qey. The authors design both hardware and software to support CTAP-based FIDO2 authenticators on an ARM platform, using ML-DSA via Open Quantum Safe with ES256 as a fallback, and they benchmark performance showing increased latency for PQC operations. They demonstrate that PQC-enabled authentication remains practical on modest hardware, while highlighting limitations in secure PQC storage and outlining paths toward hybrid cryptographic approaches and biometrics. The study advances practical PQC adoption in passwordless security and provides a concrete prototype with performance data and implementation details for future work and standardization efforts.

Abstract

Authentication systems have evolved a lot since the 1960s when Fernando Corbato first proposed the password-based authentication. In 2013, the FIDO Alliance proposed using secure hardware for authentication, thus marking a milestone in the passwordless authentication era [1]. Passwordless authentication with a possession-based factor often relied on hardware-backed cryptographic methods. FIDO2 being one an amalgamation of the W3C Web Authentication and FIDO Alliance Client to Authenticator Protocol is an industry standard for secure passwordless authentication with rising adoption for the same [2]. However, the current FIDO2 standards use ECDSA with SHA-256 (ES256), RSA with SHA-256 (RS256) and similar classical cryptographic signature algorithms. This makes it insecure against attacks involving large-scale quantum computers [3]. This study aims at exploring the usability of Module Lattice based Digital Signature Algorithm (ML-DSA), based on Crystals Dilithium as a post quantum cryptographic signature standard for FIDO2. The paper highlights the performance and security in comparison to keys with classical algorithms.

The Qey: Implementation and performance study of post quantum cryptography in FIDO2

TL;DR

This work addresses the quantum security gap in FIDO2 by implementing a post-quantum signature scheme ML-DSA (Crystals-Dilithium) within a new security key called The Qey. The authors design both hardware and software to support CTAP-based FIDO2 authenticators on an ARM platform, using ML-DSA via Open Quantum Safe with ES256 as a fallback, and they benchmark performance showing increased latency for PQC operations. They demonstrate that PQC-enabled authentication remains practical on modest hardware, while highlighting limitations in secure PQC storage and outlining paths toward hybrid cryptographic approaches and biometrics. The study advances practical PQC adoption in passwordless security and provides a concrete prototype with performance data and implementation details for future work and standardization efforts.

Abstract

Authentication systems have evolved a lot since the 1960s when Fernando Corbato first proposed the password-based authentication. In 2013, the FIDO Alliance proposed using secure hardware for authentication, thus marking a milestone in the passwordless authentication era [1]. Passwordless authentication with a possession-based factor often relied on hardware-backed cryptographic methods. FIDO2 being one an amalgamation of the W3C Web Authentication and FIDO Alliance Client to Authenticator Protocol is an industry standard for secure passwordless authentication with rising adoption for the same [2]. However, the current FIDO2 standards use ECDSA with SHA-256 (ES256), RSA with SHA-256 (RS256) and similar classical cryptographic signature algorithms. This makes it insecure against attacks involving large-scale quantum computers [3]. This study aims at exploring the usability of Module Lattice based Digital Signature Algorithm (ML-DSA), based on Crystals Dilithium as a post quantum cryptographic signature standard for FIDO2. The paper highlights the performance and security in comparison to keys with classical algorithms.
Paper Structure (10 sections, 2 figures, 3 tables)

This paper contains 10 sections, 2 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Proposed Work: The Qey
  4. Hardware Design overview of the Qey
  5. Software design overview of the Qey
  6. CTAP Implementation for The Qey
  7. Experimental Setup
  8. Performance analysis
  9. Attack Analysis
  10. Conclusion

Figures (2)

  • Figure 1: The Qey
  • Figure 2: The Qey