Multi-factor Authentication using Secure Elements: Enhancing the Usability with new Web APIs

The number of Secure Elements (SEs) embedded in devices such as mobile phones, smart watches and physical security tokens are increasing. The cryptographic services these tamper-resistant micro-controller chips provide are excellent for use in multi-factor authentication mechanisms. However, there are known limitations with the current SE solutions in Web Applications. This thesis presents an analysis of the current solutions that explains some of their limitations, in addition to an analysis of some of the proposed Web APIs and protocols with the goal of increasing the overall usability of SE solutions on the Web. A Proof of Concept (PoC) Web Application was created for this Master’s project, using Fido Alliance’s U2F protocol for multi-factor authentication. The PoC provides a high degree of usability, without the need to install any additional software components when used with Google Chrome, as it is the first major Web Browser that has built in support for the U2F Web API. In addition, the thesis discusses how the PoC and its authentication mechanism ranks on a set of recognized security assurance level frameworks for entity authentication