FIDO2/WebAuthn implementation and analysis in terms of PSD2
FIDO2/WebAuthn υλοποίηση και ανάλυση ως προς το PSD2

Master Thesis
Author
Grammatopoulos, Athanasios Vasileios
Γραμματόπουλος, Αθανάσιος Βασίλειος
Date
2022-02-22Advisor
Xenakis, ChristosΞενάκης, Χρήστος
View/ Open
Keywords
FIDO ; WebAuthn ; PSD2 ; StrongMonkey ; StrongBee ; VPN ; Password-less ; AuthenticationAbstract
FIDO is an alternative passoword-less authentication standard that can be used to replace traditional username and password authentication mechanics. FIDO leverage the use of public-private key cryptography in combination with the possession of personal authenticator devices (e.g. a laptop, a smartphone or a USB security key) to authenticate the user by requesting an additional verification through a biometric scan (e.g. a fingerprint scan) or a knowledge element (e.g. a PIN or an unlock Pattern). FIDO2 connects FIDO authenticators in the web environment, through the usage of the WebAuthn specification and thus making it ideal for providing strong client authentication (SCA) to meeting the requirements of Payment Services Directive (PSD2). In this work, we will look into how FIDO2/WebAuthn works, how FIDO can cover the SCA requirements and that issues may one face when doing so. Furthermore, FIDO2/WebAuthn solutions developed to enable the use of FIDO and ensuring strong user authentication in various application will be presented.