SandboxAQ has announced its membership in the FIDO Alliance, an open industry consortium focused on minimizing the world’s dependence on passwords—a prevalent source of security and usability problems. By joining forces with prominent FIDO Alliance members such as Amazon, Apple, Google, Intel, Microsoft, RSA, VISA, Yubico, and others, SandboxAQ aims to enhance and advance the FIDO2 protocol.
At SandboxAQ, we recognize the intrinsic connection between Modern Cryptography Management and contemporary user authentication protocols like FIDO. The FIDO Alliance champions the creation and adoption of open standards for user authentication that rely on cryptographic keys and protocols, rather than traditional passwords.
“We are excited to join the FIDO Alliance in its mission to provide secure user authentication. We look forward to applying our research and expertise to evolve the specifications and ensure continued security in the quantum era,” said Carlos Aguilar Melchor, Chief Scientist of cybersecurity at SandboxAQ.
“The FIDO Alliance welcomes SandboxAQ to its growing roster of identity cybersecurity experts dedicated to protecting the world’s most sensitive data through the use of stronger authentication solutions that eliminate reliance on passwords,” said Andrew Shikiar, CEO of the FIDO Alliance. “Contributions of SandboxAQ’s expertise in encryption management and post-quantum security stand to help the FIDO Alliance ensure web authentication remains secure against current and future cyber threats, including those posed by quantum computers.”
SandboxAQ is committed to modernizing cryptography management through its AQtive Guard platform. This platform enables enterprises to identify and manage vulnerable cryptographic algorithms and keys with unprecedented scale and precision across their entire IT infrastructure, leveraging AI techniques and modern monitoring and deployment frameworks. Cryptography management often involves hardware components that are harder to upgrade and less agile than software solutions.
The FIDO2 protocol exemplifies this hardware dependency, offering secure, passwordless authentication for web applications using hardware tokens with cryptographic credentials. While these tokens provide high security, they cannot be easily updated with newer hardware. FIDO solutions are extensively used by large organizations like Google and Cloudflare for employee authentication and are available to consumers for secure access to services on platforms such as Apple, Google, and Microsoft. The FIDO2 protocol is also used for secure access to health services, government services, and financial applications.
A recent FIDO Alliance white paper on addressing the quantum threat outlines two primary objectives: selecting the most appropriate post-quantum cryptographic algorithms and ensuring a seamless transition to post-quantum security. The R&D team at SandboxAQ’s Cybersecurity Group has made significant contributions in this area, analyzing the (post-quantum) security and privacy of the FIDO2 protocol and its attestation modes and open-sourcing the first end-to-end post-quantum secure FIDO2 implementation. SandboxAQ is enthusiastic about collaborating with the FIDO Alliance to ensure web authentication remains secure in the face of quantum computing threats.
