Implementation of a FIDO2 Authenticator Library in Zig - David Sugar - Software You Can Love VC 2023

Official website: softwareyoucan...
Vancouver Conference Website: softwareyoucan...
Slides: github.com/r4g...
Abstract:
FIDO2 is an authentication protocol developed by the FIDO alliance and the W3C that aims to replace passwords as the primary authentication method in the long run.
This talk will cover the development of a proof of concept FIDO2 library in Zig. We'll look at how FIDO2 works, how the standard library can aid us in developing cryptographic applications, and how we can use projects like TinyUSB to our advantage.

[@halfgrin]

For the transport layer i believe it's "missing" those other protocols because FIDO2 is meant to be run on a dedicated hardware device that is not a part of the users system. This is so if for example your pc gets compromised the attacker would still not be able to simply authenticate themselves using the compromised system. This is also why OTP aren't as safe as FIDO2, since if your pc or phone gets compromised the attacker might have access to your secondary security factor.
TBF i'm no expert, but that's my understanding of why it is as it is.
Anyway, kudos to David for an interesting talk/presentation :) and great to hear zig embed is getting some love :D

[@zigtoberfest]

Thanks for the comment 👍. The idea that FIDO2 is meant to be only run on dedicated hardware is a wide spread misconception. The spec clearly states so-called platform authenticators which are now marketed as Passkeys. Currently Apple and Microsoft get somewhat of a special treatment, i.e. browsers explicitly add IPC support for e.g. windows hello. Passkeys use so called discoverable credentials which are stored in a encrypted database and can be shared across devices, e.g. Apple uses their own cloud infrastructure.

[@halfgrin]

@@zigtoberfest I see... So really the dedicated hardware is just for an added layer of security as it can be removed from the system. Which would be more targeted toward enterprise users vs everyday consumers i'm guessing. Thanks for the reply and clarification ☺