mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
108 lines
2.9 KiB
TeX
108 lines
2.9 KiB
TeX
\section{Advanced Security Features}
|
|
|
|
|
|
\subsection{WebAuthn Implementation}
|
|
|
|
Lux.id implements WebAuthn for passwordless authentication using FIDO2 security keys:
|
|
|
|
\subsubsection{Registration Ceremony}
|
|
|
|
The registration process creates a public key credential:
|
|
|
|
\begin{enumerate}
|
|
\item Server generates challenge: $c = \text{random}(32)$
|
|
\item Client creates credential: $(pk, sk) = \text{KeyGen}()$
|
|
\item Authenticator signs: $\sigma = \text{Sign}(sk, c || \text{rpIdHash} || \text{flags})$
|
|
\item Server stores: $\{uid, pk, \text{credentialId}\}$
|
|
\end{enumerate}
|
|
|
|
\subsubsection{Authentication Ceremony}
|
|
|
|
Authentication verifies possession of private key:
|
|
|
|
\begin{equation}
|
|
\text{Verify}(pk, \sigma, c || \text{rpIdHash} || \text{counter}) \stackrel{?}{=} \text{true}
|
|
\end{equation}
|
|
|
|
\subsection{TOTP Implementation}
|
|
|
|
Time-based One-Time Passwords follow RFC 6238:
|
|
|
|
\begin{equation}
|
|
\text{TOTP}(K, T) = \text{HOTP}(K, \lfloor \frac{T - T_0}{X} \rfloor)
|
|
\end{equation}
|
|
|
|
Where:
|
|
\begin{itemize}
|
|
\item $K$ = shared secret key
|
|
\item $T$ = current Unix timestamp
|
|
\item $T_0$ = Unix epoch (0)
|
|
\item $X$ = time step (30 seconds)
|
|
\end{itemize}
|
|
|
|
The HOTP function is defined as:
|
|
|
|
\begin{equation}
|
|
\text{HOTP}(K, C) = \text{Truncate}(\text{HMAC-SHA1}(K, C)) \bmod 10^d
|
|
\end{equation}
|
|
|
|
\subsection{Multi-Factor Authentication}
|
|
|
|
Lux.id supports flexible MFA combinations:
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\begin{tabular}{|l|l|l|}
|
|
\hline
|
|
\textbf{Factor Type} & \textbf{Methods} & \textbf{Security Level} \\
|
|
\hline
|
|
Something you know & Password, PIN & Low \\
|
|
Something you have & TOTP, SMS, Hardware Key & Medium \\
|
|
Something you are & Biometrics, Face ID & High \\
|
|
Something you own & NFT, Wallet Signature & High \\
|
|
\hline
|
|
\end{tabular}
|
|
\caption{MFA Factor Types and Security Levels}
|
|
\end{table}
|
|
|
|
The authentication score is calculated:
|
|
|
|
\begin{equation}
|
|
\text{AuthScore} = \sum_{i=1}^{n} w_i \cdot f_i
|
|
\end{equation}
|
|
|
|
Where $w_i$ is the weight of factor $i$ and $f_i \in \{0,1\}$ indicates factor verification.
|
|
|
|
\subsection{Passkeys Support}
|
|
|
|
Lux.id implements passkeys following the FIDO Alliance specifications, enabling:
|
|
|
|
\begin{itemize}
|
|
\item Platform authenticators (Touch ID, Face ID, Windows Hello)
|
|
\item Cross-platform authenticators (YubiKey, Titan)
|
|
\item Synced passkeys (iCloud Keychain, Google Password Manager)
|
|
\end{itemize}
|
|
|
|
\subsection{Biometric Authentication}
|
|
|
|
Biometric authentication uses device-native capabilities:
|
|
|
|
\begin{lstlisting}[language=Solidity]
|
|
const credential = await navigator.credentials.create({
|
|
publicKey: {
|
|
challenge: new Uint8Array(32),
|
|
rp: { name: "Lux Network", id: "lux.network" },
|
|
user: {
|
|
id: Uint8Array.from(userId),
|
|
name: "[email protected]",
|
|
displayName: "Lux User"
|
|
},
|
|
authenticatorSelection: {
|
|
authenticatorAttachment: "platform",
|
|
userVerification: "required"
|
|
}
|
|
}
|
|
});
|
|
\end{lstlisting}
|
|
|