Following the publication of the formal security analysis of the FAPI 2.0 Security Profile in December 2022, a second round of analysis has now been completed, extending it to include FAPI 2.0 Message Signing, Dynamic Client Registration (DCR), Dynamic Client Management (DCM), and FAPI-CIBA.

The analysis was co-funded by the Australian Government and the OpenID Foundation, and executed by the team at the University of Stuttgart that previously analyzed both FAPI 1.0 and the FAPI 2.0 Security Profile, in close collaboration with the FAPI working group.

The FAPI 2.0 Attacker Model specifies security goals for authorization and authentication flows:

• For OAuth 2.0 authorization flows, an attacker must not be able to access resources belonging to a user. Additionally, the attacker must not be able to force a user to use the resource of the attacker (instead of their own resources).
• For authentication flows that use OpenID Connect, an attacker must not be able to log in under the identity of a user. And neither must an attacker be able to force a user to be logged in under an identity of the attacker (instead of their own identity).

In addition to these security goals, FAPI 2.0 Message Signing also specifies non-repudiation requirements, where the general idea of non-repudiation is that “If an honest party A accepts a message (it expected to be signed) signed with a key of an honest party B, the message was signed by B”. The non-repudiation requirements apply to:

• Pushed Authorization Requests
• Authorization Responses
• Introspection Responses
• Resource Requests/Responses

The analysis of the aforementioned security properties is based on the Web Infrastructure Model (WIM), which is a detailed formal model of the Web infrastructure. The report provides an overview of the protocols and extensions analyzed and the security goals considered. In order to facilitate the analysis and prove the security properties based on the given formal model, a set of modeling decisions and assumptions were made, and the report goes into detail on all of these and explains the reasoning behind them.

As a result of this work, the researchers at the University of Stuttgart, Institute of Information Security led by Prof. Ralf Küsters, Pedram Hosseyni and Tim Würtele, have been able to prove the security properties listed above. This result should give implementers of FAPI 2.0 further confidence in the security benefits of implementing the specifications.

For more information, please consult the final report.

About the OpenID Foundation

The OpenID Foundation’s vision is to help people assert their identity wherever they choose. And our mission is to lead the global community in creating identity standards that are secure, interoperable, and privacy-preserving. 

Founded in 2007, the OpenID Foundation (OIDF) is a non-profit open standards body developing identity and security specifications that serve billions of consumers across millions of applications.

Learn more here: https://openid.net/foundation/