Re: [kitten] SPAKE Preauth

[Ken Hornstein <[e-mail]>]

>> I do not quite understand your point ... are you saying that your I-D
>> should completely specify how all 2FA systems work with SPAKE?  And
>> personally I'd vote to keeping SPAKESecondFactor an Int32 rather than
>> an OID.
>
>No. I'm saying a vendor can define their own 2FA and assign it an
>enterprise OID number and use it out of the box. No standardization
>required.
>
>Then we would create some IETF OIDs for open protocols (such as OATH
>and U2F).

I'm wondering how that is better than the "normal" Kerberos scheme where
vendors can register their 2FA or whatever with IANA.

And on further thought ... I realize that I'm strongly with Nico in that
a generic OTP should be specified somewhere.  I know you mentioned U2F,
but that just seems like an additional unnecessary layer (also, the U2F
protocol seems to be web-specific, in that it mentions adding the origin
URL and TLS channel ID to the authentication flow).  Sure, if people
want to use U2F no objections here, but it just seems lousy that the
initial specification(s) don't mention a generic OTP protocol; like Nico
said, there are a ton of these devices.

--Ken