Re: [kitten] Fwd: I-D Action: draft-melnikov-scram-2fa-00.txt

[Simon Josefsson <[e-mail]>]

Thanks for working on this.  What we discovered with the OpenID/SAML
SASL mechanisms was that a major challenge was to resolve how to resume
sessions in a SASLy way.  To be more specific, the challenge is that a
lot of client applications (IMAP in particlar) expect to be able to open
several sessions to the server.  Having a user perform manual steps per
session won't work, and from a quick look at your document, it looks
like this problem isn't resolve here either.  What is needed is some way
to perform the 2FA authentication once, and then be able to refer to
that authentication in a new SASL authentication step.  With re-newed
energy and interest in this, I beliece we can do better now though.
Some ideas:

1) Specify how TLS resumption of a SASL authenticated session should
assume the same SASL authentication/authorization identity.

2) Specify how EXTERNAL (or some new mechanism) is to be used to
"resume" an earlier 2FA authenticated SASL session.

3) Describe how OAUTH could be used to achieve this.

4) Extend your proposal to generate a magic cookie after successful
authentication that can be provided instead of the 2FA code next time.

The problem is not exactly how to do it: it is to describe one
well-agreed on method that all application implementers can follow, to
get interoperability.

I believe it is a bad idea to implement a generic 2FA mechanism on top
of SCRAM, it will be too flexible with bad interop as a result.
Instead, implement specific 2FA methods so things become easily
implementable.  Your document could be a SCRAM-OATH-TOTP rather than
SCRAM-2FA.  OATH-HOTP/TOTP, U2F, FIDO2, etc each have different
behaviours that make it difficult to support in a generic protocol.

/Simon

Alexey Melnikov <[e-mail]> writes:

> Hi all,
>
> As I had various conversations with people saying that SASL doesn't
> support 2 factor authentication, I posted a short draft which shows
> how to add 2 factor authentication to SCRAM. This is mostly a proof of
> concept and I am planning to work on another draft explaining how to
> do the same for SASL OAUTH.
>
> (If I remember correctly I also talked to Dave Cridland about doing a
> more generic extension to the SASL framework itself by allowing
> protocols to invoke multiple SASL mechanism in a sequence and
> achieving 2FA that way. I would be interested in developing this
> concept as well, but it would take longer than just extending some
> existing SASL mechanisms.)
>
> If people can have a look and provide feedback, that would be much
> appreciated.
>
> Best Regards,
> Alexey
> -------- Forwarded Message --------
> Subject: 	I-D Action: draft-melnikov-scram-2fa-00.txt
> Date: 	Thu, 19 Mar 2020 06:17:40 -0700
> From: 	[e-mail]
> Reply-To: 	[e-mail]
> To: 	[e-mail]
>
>
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>
>
> Title : Extensions to Salted Challenge Response (SCRAM) for 2 factor
> authentication
> Author : Alexey Melnikov
> Filename : draft-melnikov-scram-2fa-00.txt
> Pages : 5
> Date : 2020-03-19
>
> Abstract:
> This specification describes an extension to family of Simple
> Authentication and Security Layer (SASL; RFC 4422) authentication
> mechanisms called the Salted Challenge Response Authentication
> Mechanism (SCRAM), which provides support for 2 factor
> authentication.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-melnikov-scram-2fa/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-melnikov-scram-2fa-00
> https://datatracker.ietf.org/doc/html/draft-melnikov-scram-2fa-00
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
>
> _______________________________________________
> I-D-Announce mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> _______________________________________________
> Kitten mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/kitten
>