EN 
Formally verified
Fenrir’s model has been formally verified even before the implementation began.
The current proof has been done in Proverif, and we will work on others in the near future.
This means that the interactions between the client and servers are secure, and we have mathematical proof that there is no flaw in the key exchange.
While this does not exclude implementation errors, it is already a big step the widespread protocols like TLS did not have for decades after they were deployed.
Security Layering
Fenrir is designed with multiple levels of security to protect against attacks coming from outside and inside.
Instead of handling passwords, we use tokens. Tokens are just random passwords, but unlike your passwords it’s impossible to guess them based on knowledge of the user such as language, location or other.
We could have stopped at handling tokens, but we turned them into One Time Passwords. Not only this is more secure, each device can now check the details on the OTP and it will be able to immediately recognize if there has been one unauthorized access because someone hacked or copied the contents of your phone or laptop.
The services store a client key, and now the server can not impersonate a client anymore, and can’t even do MITM attacks. This means that even if the authentication server is hacked, the hackers won’t be able to use it to steal user’s data!
We are working on introducing authentication levels: You might not care much about logging into your music provider, but you probably want your bank to have a much more secure login.
Fenrir will let you and the bank decide which is the minimum level of security: is a normal login enough? Do you want confirmation from another device? Maybe only with a USB key?
Handshake Hardening
We have created 3 different handshakes, a very fast one, a normal one and a slow one, depending on how much your server is under attack.
On normal usage your server will just use the fast one, but if it is under a DDOS attack it will automatically switch to the slower one, which consumes much less server resources.
App&Service simplification
Developers take time to integrate a proper login flow into their application, and the same is true on the server side.
But with Fenrir you don’t have to: once you have a connection, you instantly know who the user is. You don’t need to handle tokens, keys, additional libraries for services. Just write your application!
This increases security simply because developers don’t dedicate enough time to securely handle all aspects of the authentication process. That’s our job, your job is the application development.
Authentication scope
A user might not trust his cheap, second hand phone, or a company might have strict policies on access from mobile devices.
In both cases, wouldn’t it be useful to let one application or device only read the contents of a website, and remove its ability to perform dangerous operations like payments or content deletion?
With Fenrir you can force the maximum level of operation that a whole device, or a single application, can perform.
This way you could safely leave your bank account on your phone, knowing at the worst someone will know how much money you have, but will never be able to send money elsewhere