astronomy

Universal 2nd Factor

Universal 2nd Factor is a astronomy topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Universal 2nd Factor rather than just read about it. In short: Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized Universal Serial Bus (USB), near-field communication (NFC), or Bluetooth Low Energy (BLE) devices based on similar security technology found in smart cards. It is superseded by the FIDO2 Project, which includes the W3C Web Authentication (WebAuthn) standard and the FIDO Alliance's Client t…

Key takeaways

Universal 2nd Factor belongs to astronomy; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Universal 2nd Factor to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Universal 2nd Factor from memory before moving on to harder problems.

Reference excerpt

Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized Universal Serial Bus (USB), near-field communication (NFC), or Bluetooth Low Energy (BLE) devices based on similar security technology found in smart cards. It is superseded by the FIDO2 Project, which includes the W3C Web Authentication (WebAuthn) standard and the FIDO Alliance's Client to Authenticator Protocol 2 (CTAP2). While initially developed by Google and Yubico, with contribution from NXP Semiconductors, the standard is now hosted by the FIDO Alliance.

While time-based one-time password (TOTPs) (e.g. 6-digit codes generated on Google Authenticator) were a significant improvement over SMS-based security codes, a number of security vulnerabilities were still possible to exploit, which U2F sought to improve. Specifically:

In terms of disadvantages, one significant difference and potential drawback to be considered regarding hardware-based U2F solutions is that unlike with TOTP shared-secret methods, there is no possibility of "backing up" recovery codes or shared secrets. If a hardware duplicate or alternative hardware key is not kept and the original U2F hardware key is lost, no recovery of the key is possible (because the private key exists only in hardware). Therefore, for services that do not provide any alternative account recovery method, the use of U2F should be carefully considered.

Design The USB devices communicate with the host computer using the human interface device (HID) protocol, the same protocol used by mice, keyboards, and other input devices. This avoids the need for the user to install special hardware driver software in the host computer and permits application software (such as a browser) to directly access the security features of the device without user effort other than possessing and inserting the device. Once communication is established, the application exercises a challenge–response authentication with the device using public-key cryptography methods and a secret unique device key manufactured into the device.

Vulnerabilities The device key is vulnerable to malicious manufacturer duplication. In 2020, independent security researchers found a method to extract private keys from Google Titan Key, a popular U2F hardware security token. The method required physical access to the key for several hours, several thousand euros-worth of equipment, and was destructive to the plastic case of the key. The attackers concluded that the difficulty of the attack meant that people were still safer to use the keys than not. The attack was possible due to a vulnerability in the A700X microchip made by NXP Semiconductors, which is also used in security tokens made by Feitian and Yubico, meaning that those tokens are also vulnerable. The vulnerability was responsibly disclosed to the affected manufacturers so that it might be fixed in future products.

Support and use U2F security keys are supported by Google Chrome since version 38, Firefox since version 57 and Opera since version 40. U2F security keys can be used as an additional method of two-step verification on online services that support the U2F protocol, including Google, Azure, Dropbox, GitHub, GitLab, Bitbucket, Nextcloud, Facebook, and others. Chrome, Firefox, and Opera were, as of 2015, the only browsers supporting U2F natively. Microsoft has enabled FIDO 2.0 support for Windows 10's Windows Hello login platform. Microsoft Edge browser gained support for U2F in the October 2018 Windows Update. Microsoft accounts, including Office 365, OneDrive, and other Microsoft services, do not yet have U2F support. Mozilla has integrated it into Firefox 57, and enabled it by default in Firefox 60 and Thunderbird 60. Microsoft Edge starting from build 17723 support FIDO2. As of iOS and iPadOS 13.3 Apple now supports U2F in the Safari browser on those platforms.

Specifications

The U2F standard has undergone two major revisions:

U2F 1.0 Proposed Standard (October 9, 2014) U2F 1.2 Proposed Standard (April 11, 2017) Additional specification documents may be obtained from the FIDO web site. The U2F 1.0 Proposed Standard (October 9, 2014) was the starting point for a short-lived specification known as the FIDO 2.0 Proposed Standard (September 4, 2015). The latter was formally submitted to the World Wide Web Consortium (W3C) on November 12, 2015. Subsequently, the first Working Draft of the W3C Web Authentication (WebAuthn) standard was published on May 31, 2016. The WebAuthn standard has been revised numerous times since then, becoming a W3C Recommendation on March 4, 2019. Meanwhile the U2F 1.2 Proposed Standard (April 11, 2017) became the starting point for the Client to Authenticator Protocol (CTAP) Proposed Standard, which was published on September 27, 2017. FIDO CTAP complements W3C WebAuthn, both of which are in scope for the FIDO2 Project. WebAuthn and CTAP provide a complete replacement for U2F, which has been renamed "CTAP1" in the latest version of the FIDO2 standard. The WebAuthn protocol is backward-compatible (via the AppID extension) with U2F-only security keys but the U2F protocol is not compatible with a WebAuthn-only authenticator. Some authenticators support both U2F and WebAuthn while some WebAuthn clients support keys created via the legacy U2F API.

References

Worked examples

Example 1 — a first encounter with Universal 2nd Factor

Start with the simplest possible case. Write down what Universal 2nd Factor claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In astronomy, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Universal 2nd Factor before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Universal 2nd Factor ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Universal 2nd Factor

In research: Universal 2nd Factor appears in astronomy research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Universal 2nd Factor in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Universal 2nd Factor is common in secondary-school and first-year university syllabi. It links to neighbouring topics Authentication protocols, Computer access control protocols, Internet Standards, so understanding it makes those chapters shorter.
In everyday life: Look for Universal 2nd Factor outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Universal 2nd Factor in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Universal 2nd Factor means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Universal 2nd Factor out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Universal 2nd Factor in simple terms?

Why does Universal 2nd Factor matter?

Because it connects several astronomy ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Universal 2nd Factor?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Universal 2nd Factor.