Subject: Interest in a push-based two-factor auth standard?

From: Alex Jordan <[email-masked]>
Date: Thu, 2 Mar 2017 00:51:28 -0500

Heya!

A widely deployed way to do two-factor authentication is
TOTP. However, when used with an Android device Google Accounts have a
really nice flow where Google will send a push notification to the
Android device, which will then prompt the user with a "yes/no"
question as to whether they were trying to log in or not. From a UX
perspective this is much nicer than opening an app, manually typing in
a code, etc.

With WebPush core having been just ratified as RFC 8030, the time
seems ripe for standardizing an authentication scheme like described
above.

I have two questions:

1. Is there interest in creating such a standard at the IETF?

2. If there is, where would be the best place to do that work? I'm
relatively new to the IETF - I poked around Datatracker's list of
Working Groups and there didn't seem to be one that really fit that
well. Did I miss something? Or should this go through the IETF
individual submission track?

Please CC me on replies; I'm not subscribed.

Cheers!

AJ

---

From: Ted Hardie <[email-masked]>
Date: Thu, 2 Mar 2017 08:33:52 -0800

Hi Alex,

The applications area uses a working group called DISPATCH to answer the
question "where should this work go?", so you might start by writing up the
idea as an Internet draft and submitting to DISPATCH.  The Security area
uses the saag list for similar discussion, if you think it is more of a
security topic than a usage of web push.

regards,

Ted

---

From: Alex Jordan <[email-masked]>
Date: Fri, 3 Mar 2017 16:23:21 -0500

*sigh* CC'ing the list, which I forgot to do...

On Fri, Mar 03, 2017 at 04:20:35PM -0500, Alex Jordan wrote:
> On Thu, Mar 02, 2017 at 08:33:52AM -0800, Ted Hardie wrote:
> 
> Thanks, that's very helpful. I'll take discussion there when I have an
> Internet-Draft ready.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 6 Mar 2017 08:05:11 -0500

> Please CC me on replies; I'm not subscribed.

​i am interested and have developed several protocols of this type using
JSON. My work provides prior art back to 2010 at the very least.

What we are discussing goes beyond two factor auth. If you have a cell
phone with a device specific signature key, it can sign the response which
means that you automatically collect up a non repudiable audit log of the
user's actions. This is beyond anything possible with OTP number sequences
or USB dongles.

​

---

From: Alex Jordan <[email-masked]>
Date: Tue, 7 Mar 2017 15:37:19 -0500

> user's actions. This is beyond anything possible with OTP number sequences

Indeed. I suspect there are a lot of unexplored uses for such a
standard, but haven't explored it fully yet. (Note also that the lack
of deniability could be seen as a positive thing _or_ a negative
thing, depending.)

> JSON. My work provides prior art back to 2010 at the very least.

Are there any public references for this work?

I think what makes most sense at this point is for me to draw up a
rough Internet draft and then send it to the Security area and see
what they think the best way forward is. Looking at prior work will
probably aid in the design of such a draft.

Does that seem okay to those who have expressed interest in this?

Cheers!

AJ

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 7 Mar 2017 21:02:49 -0500

> Are there any public references for this work?

https://tools.ietf.org/id/draft-hallambaker-owcp-00.txt
https://tools.ietf.org/html/draft-hallambaker-sxs-confirm-02

​That is not the latest version.​ There might even be a later published
version.

I have code. The reason I have not updated the drafts is that right now I
am working on the problem of binding all the user's devices together so
that they can respond to a confirmation request from their phone or their
watch or any other device(s) they pick. Each device always signs with a
unique device key however so the signatures can be tracked back to the
device used.