Creating a Roaming Authenticator

A roaming authenticator is a type of authenticator which is not bound to any device. The authenticator can be used with any number of devices. It is assumed that these authenticators have an internal matcher. The matcher is able to verify an already enrolled user and can support multiple users.

Roaming Authenticator Types

First Factor Roaming Authenticator

These authenticators are designed to store key handles in their own internal secure storage and not expose them externally. These authenticators may also work as a second factor:

• A Bluetooth LE-based hardware token with built-in fingerprint sensor

• A PIN protected USB hardware token

• A first factor bound authenticator acting as a roaming authenticator for a different device on the user's behalf

Second Factor Roaming Authenticator

These authenticators do not store key handles in their own internal storage, but instead push key handles to the FIDO Server and receive them back during the authentication operation. These authenticators can only work as second factor authenticators:

• A USB dongle with a built-in capacitive touch device for verifying user presence

• A "Trustlet" application running within the Trusted Execution Environment of a mobile phone and leveraging a secure keyboard to verify user presence

For more information about roaming authenticators, see FIDO UAF Authenticator Commands v1.2.

ASM Architecture with Roaming Authenticator

The architecture is very similar to the regular ASM architecture. The difference is that, in the case of the roaming authenticator, the matcher is not required, because the matcher functionality should be implemented in the external authenticator. The implementation for IAuthenticatorKernel should provide a communication channel (Bluetooth, USB, etc.,.) to send requests to and receive responses from the external authenticator.

Adding Support for the Roaming Authenticator

The Authenticator SDK allows you to add Roaming Authenticator support to your ASM. The steps for creating the Roaming Authenticator are similar to the steps for customizing Sample ASM as described in the corresponding sections of this document, but some specific steps are required. These steps include following:

• Develop a FIDO Crypto Module for your external authenticator. The module must conform to requirements in the FIDO UAF Authenticator Commands v1.2. In addition to standard commands, it also needs to implement the GetRegistrations command. This command is not a part of the UAF spec, but is required by the ASM Core. In this way, the external authenticator can inform the ASM about existing registrations in its database. The format of the request and response messages are shown below.

GetRegistrations Request

GetRegistrations Response

• Develop the IAuthenticatorKernel Implementation. It should provide a communication channel to the external authenticator.

• Develop the AK selector. This step is similar to the corresponding step for customizing the Sample ASM. See section Using an Alternate FIDO Crypto Module for details.

• Develop the descriptor. This step is similar to the corresponding step for customizing the Sample ASM. The following is the list of additional changes required to support roaming authenticators:

  • The isRoamingAuthenticator method must return true

  • The isSecondFactorOnly method must return the correct value based on the type of roaming authenticator.

  • The metadata file should be configured accordingly.

The Matcher implementation is not required in the case of a Roaming Authenticator, as the corresponding functionality should be implemented in the external authenticator.