How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy

Michal Kepkowski, Lucjan Hanzlik, Ian Wood +1

This paper presents a timing attack on the FIDO2 (Fast IDentity Online) authentication protocol that allows attackers to link user accounts stored in vulnerable authenticators, a s…