BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1 Federation Threats

NIST PIV and digital identity SP 800-63C
All changes in this version
first version loaded 8 Security part of 8

Title

Federation Threats

Control

As in non-federated authentication, attackers’ motivations are typically to gain access (or a greater level of access) to a resource or service provided by an RP. Attackers may also attempt to impersonate a subscriber. Rogue or compromised IdPs, RPs, user agents (e.g., browsers), and parties outside of a typical federation transaction are potential attackers. To accomplish their attack, they might intercept or modify assertions and assertion references. Further, two or more entities may attempt to subvert federation protocols by directly compromising the integrity or confidentiality of the assertion data. For the purpose of these types of threats, any authorized parties who attempt to exceed their privileges are considered attackers.

In some cases, the subscriber is issued some secret information so they can be recognized by the RP. Knowledge of this information distinguishes the subscriber from attackers who wish to impersonate them. In the case of holder-of-key assertions, this secret could have been established with the IdP prior to the initiation of the federation protocol.

Table 8-1 Federation Threats

Federation Threat/Attack Description Example

Assertion Manufacture or Modification The attacker generates a false assertion Compromised IdP asserts identity of a claimant who has not properly authenticated

The attacker modifies an existing assertion Compromised proxy that changes AAL of an authentication assertion

Assertion Disclosure Assertion visible to third party Network monitoring reveals subscriber address of record to an outside party

Assertion Repudiation by the IdP IdP later claims not to have signed transaction User engages in fraudulent credit card transaction at RP, IdP claims not to have logged them in Federation Threat/Attack Description Example

Assertion Repudiation by the Subscriber Subscriber claims not to have performed transaction User agreement (e.g., contract) cannot be enforced

Assertion Redirect Assertion can be used in unintended context Compromised user agent passes assertion to attacker who uses it elsewhere

Assertion Reuse Assertion can be used more than once with same RP Intercepted assertion used by attacker to authenticate their own session

Assertion Substitution Attacker uses an assertion intended for a different subscriber Session hijacking attack between IdP and RP