Re: [kitten] Fwd: I-D Action: draft-melnikov-scram-2fa-00.txt

In XMPP-land, we did this by having an extended SASL profile that could ask
explicitly for TOTP (and password changes, and other things of that ilk).

https://xmpp.org/extensions/xep-0388.html (Extensible SASL Profile)
https://xmpp.org/extensions/xep-0400.html (TOTP 2FA for the above)

This detaches the choice of authentication mechanism from the choice of
second factor, as well as allowing other exciting options for all your
authentication needs.

I've personally implemented these in servers and clients, and they appear
to work well.

On Thu, 19 Mar 2020 at 13:26, Alexey Melnikov <alexey.melnikov@isode.com>
wrote:

> Hi all,
>
> As I had various conversations with people saying that SASL doesn't
> support 2 factor authentication, I posted a short draft which shows how to
> add 2 factor authentication to SCRAM. This is mostly a proof of concept and
> I am planning to work on another draft explaining how to do the same for
> SASL OAUTH.
>
> (If I remember correctly I also talked to Dave Cridland about doing a more
> generic extension to the SASL framework itself by allowing protocols to
> invoke multiple SASL mechanism in a sequence and achieving 2FA that way. I
> would be interested in developing this concept as well, but it would take
> longer than just extending some existing SASL mechanisms.)
>
> If people can have a look and provide feedback, that would be much
> appreciated.
> Best Regards,
> Alexey
> -------- Forwarded Message --------
> Subject: I-D Action: draft-melnikov-scram-2fa-00.txt
> Date: Thu, 19 Mar 2020 06:17:40 -0700
> From: internet-drafts@ietf.org
> Reply-To: internet-drafts@ietf.org
> To: i-d-announce@ietf.org
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>
>
> Title : Extensions to Salted Challenge Response (SCRAM) for 2 factor
> authentication
> Author : Alexey Melnikov
> Filename : draft-melnikov-scram-2fa-00.txt
> Pages : 5
> Date : 2020-03-19
>
> Abstract:
> This specification describes an extension to family of Simple
> Authentication and Security Layer (SASL; RFC 4422) authentication
> mechanisms called the Salted Challenge Response Authentication
> Mechanism (SCRAM), which provides support for 2 factor
> authentication.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-melnikov-scram-2fa/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-melnikov-scram-2fa-00
> https://datatracker.ietf.org/doc/html/draft-melnikov-scram-2fa-00
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
>
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>