OneID Technology Overview

By Steve Kirsch

Many security experts consider identity to be the most important problem to be solved on the Internet today. The problems with identity include too many usernames and passwords to manage, people using the same passwords at multiple sites, centralized break-ins exposing shared secrets such as passwords and credit card information, phishing, keylogging, malware attacks, updating your attribute information at relying parties when it changes, and so on. I made a list of over 60 problems with the current identity system that OneID can solve.

Passwords managers do nothing to solve these problems. They only make life a bit more manageable for users. So they actually make things worse by allowing sites to keep using the same 50 year old paradigms for authentication and authorization.

Social logins, such as Facebook Connect, aren’t a good solution either. They are convenient, but they aren’t secure or private and they often lead to some unpleasant surprises for users. You can’t use them on any high value websites such as healthcare, financial services, or e-commerce sites.

The reason many of us have hundreds of usernames and passwords is actually really simple: because of all the security breaches, few sites trust any third party to be a reliable and trustworthy provider of identity.

That’s why we started OneID. To change that. To become the first trustworthy third party identity provider. If we are successful, sites will no longer have to go into the identity provider business and could instead focus their time and energy on their unique value added services.

We know existing solutions don’t work. If  there was an existing solution that worked, we wouldn’t have major security breaches every month.

So we are led to an inevitable conclusion: the only viable way to solve the problem is to re-think identity from the ground up. That’s exactly what we did. We started with a clean sheet of paper and no restrictions. Our goal was to fix as many of the problems with identity as we could. So you’d have security in an insecure world.

OneID was designed to be the ultimate digital identity: a digital identity that you could use anywhere for anything.  Desktop, mobile, in-person, over the phone, consumer, and enterprise. Easy, secure, and private. A single permanent identity that you control, that can never be stolen or forgotten, and that would never have to be changed. As easy to sign into as Facebook Connect, as easy to buy as Amazon 1-click, and as secure as the strongest 2-factor authentication techniques. The world’s most trusted 3rd party Identity as a Service (IaaS). The best technology to replace the use of username/passwords. Authentication, authorization, information sharing, digital claims, identity proofing, and more. One identity to rule them all. That is the OneID vision.

We established five goals for OneID: convenience, security, privacy, control, and interoperability. We wanted to excel at all five goals simultaneously, not trade off security for convenience. We wanted a system that would be more secure AND more convenient AND more private AND more control all at the same time.

So we spent a year going through 23 different architectures and came up with one that all the experts told us was a clever, elegant, innovative solution to the problems plaguing identity today.

OneID relies on one or two devices, the OneID-enabled device (device the user is using for the transaction) and the OneID Remote app (an app running on the user’s mobile phone) as well as the user’s OneID credential repository.  The user’s device and OneID credential repository are required in order to complete a OneID authentication. The user’s Remote app may optionally be added to provide a higher level of assurance of the user’s consent to perform the transaction. The user may choose to lock out individual devices or to force them into a higher security mode, such as requiring entry of a PIN or requiring express approval from a OneID Remote. By using these controls, users can minimize their exposure should a user device be lost, stolen, or used without authorization.

Here’s a very simplified explanation of five common OneID operations:

1.       Create a new OneID. When you create a OneID account, it creates a unique digital signature in your browser and stores the secret to creating that signature in the browser’s HTML 5 local storage. So your device is the only computer in the world that can create your signature. There is no need for a username or password, but you can define a password if you want.

2.       Create a new account at a website. When you create an account at a website, you give the site  a sample of your signature. This allows the website to verify your signature when you sign in in the future, but only you can create your signature.

3.       Sign into a website. When you click OneID Sign In on a website, the website asks you to digitally sign your sign in request. You sign it and send it back to the website. The website compares your signature to the signature on file and, if it matches, it lets you in.

4.       Add OneID to your other devices. To add OneID to a new device, you’ll need access to a browser which already has your identity. You can then copy the secrets from that device to a new device by scanning a QR code on the new device (or by clicking on a hyperlink in your email on the new device).

5.       Share your information. When a site asks you for information, such filling out a form, your browser will download the encrypted information from the OneID servers, decrypt it locally, give it to the website, and then forget it. OneID never sees your information and it is not accessible on your computer after the transaction.

 

Logging into a website with OneID and optional OOB approval

 

Here is a detailed explanation of what happens when a OneID user logs into a website:

1.       The user's browser accesses website and the website returns a digital challenge (consisting of the request itself and a nonce) and requests that the user sign the challenge using two or three private signature keys known only to the devices signing the challenge. The cryptographic secrets are stored in HTML 5 local storage.

2.   The user browser generates the appropriate cloud repository decryption keys and passes the challenge, asymmetric proof of the identity of the browser (each browser has a unique device ID), the encrypted request, and the decryption keys to the OneID identity provider service (“the OneID Service”) associated with the user’s identity

3.   (Optional) If out of band (OOB) approval is specified by either the user or the website, the OneID Service sends the challenge to the user’s OneID Remote app.

4.   (Optional) The OneID Remote app decrypts the request, displays it to the user, and If the user consents, the Remote app will sign the challenge using a private signature key known only to OneID Remote apps owned by the user.

5.   If all of the requirements specified by the user and the website are satisfied and if the OneID Service determines that all of the user devices who proved their identity to the Service are currently authorized devices and have presented the necessary Level of Assurance asymmetric proofs (such as a PIN proof or Password proof), the OneID service will sign the challenge and return the signed challenges to the user’s device.

6.   The user’s browser displays the request to the the user (if appropriate), and if the user clicks "OK" it will sign the challenge using a private signature key known only to the user's authorized web browsers and specific to the website and returns all three signed challenges to the website, which verifies all signatures are correct and grants access to the user. Each website has a unique set of public keys associated with the user. The website never talks directly to the OneID Service so neither the website or the OneID Service know about each other.

 

In order to achieve our  goals for OneID, we had re-invent identity from the ground up. In particular,

1.       We replace the use of all shared secrets (such as usernames, passwords, PIN, etc) with asymmetric cryptography.  We use NSA-approved public key cryptography (Suite B).

2.       We store your identity on your devices, and on our servers. OneID distributes the cryptographic secrets of a user’s identity (there are 8 independent secrets in a typical OneID identity) across two different classes of devices owned by the user as well as a cloud server (the “repository”) operated by the user’s chosen OneID identity provider. Digital signatures are generated by your devices using secrets found only on your devices. Your identity can never be used without involving at least one of your devices, so your identity remains secure even if someone breaks into any of the sites you use (including OneID). 

3.       Our servers help you out, but we know almost nothing about you. OneID servers are only used to facilitate transactions and store your encrypted data. Your information can only be decrypted by the browsers you’ve expressly authorized. We don’t know the sites you visit or what is in your profile. We only store your name and email address for administrative purposes.

4.       We never trust a single signature since anything can be compromised. OneID protocols always requires at least 2 ECDSA digital signatures for basic transactions and require 3 digital signatures for secure transactions. At least one of the digital signatures must be from a device controlled by the user and at least one must be from the user’s repository provider.

5.       We let you have it your way regarding security and convenience. We allow the user to manage how his identity is secured on a per site, per device, and per transaction basis with his cloud repository enforcing his wishes so even if his device was compromised, his identity would still be secure.

6.       We provide five choices for LoA and enforce the highest security demanded. We provide 5 different levels of assurance (none, password, out-of-band, and out-of-band + PIN, and locked) to users and sites. We always enforce the highest LoA requested for that transaction by the user and the site.

7.       You don't have a username; a password is optional. Users hate usernames and passwords, so OneID shouldn’t require either one. While this sounds impossible and insecure when you first hear about it, it is possible because OneID pre-authorizes devices using devices that have your identity. So I select my name from a pick list and optionally type a password to authenticate to OneID from a browser. In my case, I have no username and my password is "x." Even though you know my username (none) and password (x), you will never be able to use my identity. You'd need 4 things to compromise my identity: my laptop, my cell phone, my password, and my PIN code. Good luck! And if I discover my identity has been compromised, I can easily disable it without even having to change my password or PIN or any of the registered public keys at any relying party (RP).

Those are the most important concepts, but there are actually over 35 innovative ideas incorporated in the OneID architecture that make us different than any other identity provider.

The implications of these decisions include:

1.       In order to use a new device with OneID you must first pre-authorize it by transferring your secrets from an existing device to your new device.

2.       It is very easy to login to OneID. You can log into a device just by clicking your name.

3.       It is very easy to log into websites because once you log into OneID, you can just hit the OneID login button on each site to securely log into that site.

4.       Operations such as login and authorizing a purchase are end-to-end secure.

5.       There is no chance of a centralized break in at any participating website or at OneID ever exposing any secrets because only public keys are stored at OneID and at each relying party.

6.       There is no single point of failure that can compromise our user’s identity (because we require at least two independent digital signatures).

7.       Users get to “have it their way” with respect to security, convenience, privacy, and control.

8.       Your identity can never be asserted without your express consent.

9.       No personally identifiable information (PII) is ever stored on our user’s devices. It is all encrypted in the OneID repository. But all the decryption keys are held by the users inside their devices.

10.   The unique user-centric OneID architecture guarantees that OneID is very private. The OneID provider doesn’t know what information you are storing or what websites you are visiting. Similarly, the sites cannot find out where your identity is stored.

11.   OneID supports two-factor authentication and authorization that is in-band (single device) as well as out-of-band (OOB) and end-to-end secure transactions. That means OneID is much more secure than plain 2-factor (such as RSA SecurID). And there is no transcribing a 6 digit number from device to device. It's much more secure (no MITM/MITB attacks) and more convenient for users. Also, we rarely invoke 2-factor OOB; it's used for exceptional transactions (such as high dollar spend or wire transfer money to a new payee).

Key benefits

  • No username/password to remember

  • Can be integrated into a site in just a few hours

  • Self-managed identity and devices

  • Easy to use

  • 2 factor (including both in-band and out-of-band) when you (or the service provider) requires it

  • Secure: Immune to phishing, keylogging, malware, cloning, no mass breaches

  • Private: unique public keys for each RP, no tracking, no cc exposure to merchant if site supports our new end-to-end secure CNP transactions

  • User in control; can’t assert w/o user OK

  • End-to-end security (signed at user device; verified at RP)

  • Users already know how to use it so no support issues

  •  ...and much more...

From a University of Cambridge study on Passwords:

The continued domination of passwords over all other
methods of end-user authentication is a major embarrassment
to security researchers. As web technology moves
ahead by leaps and bounds in other areas, passwords
stubbornly survive and reproduce with every new web
site. Extensive discussions of alternative authentication
schemes have produced no definitive answers.
Over forty years of research have demonstrated that
passwords are plagued by security problems [2] and
openly hated by users [3].

Conclusion
Wouldn't it be great if you could have a single secure, private, easy to use identity that you could use anywhere for anything? That's the vision of OneID.

Please help spread the word and together we can make that vision a reality.

For more information see:
OneID documentation guide