Re: [OAUTH-WG] Stephen Farrell's Discuss on draft-ietf-oauth-amr-values-05: (with DISCUSS)

["Manger, James" <[e-mail]>]

> You can call me lazy if you want.  Some of them are so well known, such as "password" or "PIN" it didn't seem worthwhile to try to track down a reference. 

"password" and "PIN" are so well known, yet curiously they are quite different as "amr" values.
"pwd" is merely defined as "password-based authentication".
But "pin" is not just a short numeric password. The "pin" amr value means authentication uses a (probably device-specific) crypto key that was unlocked with a local PIN or pattern and has defences against repeated guesses.

As a relying party, seeing "pin" means if it is an attacker they needed the user's device and to know their PIN (within a couple of guesses), and there shouldn't be much systemic risk from server-side password DB breaches.
Seeing "pwd" means if it is an attacker they needed to guess the user's password or get it from a password breach. Whether it is was a user-chosen password with zero restrictions and susceptible to dictionary attack, or a 12-char upper+lower+numeric+symbol not-in-common-list changed-monthly not-in-last-20 password, you don't know.


As to the "Specification Document(s)" column in the registry, it would better to leave it blank for those values where the spec provides nothing beyond the Name and Description that are in the registry anyway (such as "iris", "fpt", "geo", iris", "pwd", "retina", "sc", "sms", "tel", "user", "vbm").
In some other cases the only thing in the spec, but not the registry, is a reference to another spec so wouldn't it be better to put that reference in the registry directly. For instance, { kba; Knowledge-based authentication; [NIST.800-63-2] [ISO29115]}. Similarly for "hwk", "rba", "otp", "swk", "wia".


--
James Manger