0

I was thinking of a OTP algorithm that signs a randomly generated password.

There are two things at play here:

  1. The MFA portal
    • Knows the public key of the user's MFA app
  2. The user's MFA app
    • Has a private key stored

Here is a login flow:

  1. The user logs in and is directed to the MFA portal
  2. The MFA portal generates a code
  3. The user enters the code into their MFA app
  4. The MFA app signs the code using the private key
  5. The user enters the signed code into the MFA portal
  6. The MFA portal verifies the signature against the stored public key

After step 2, the user has a limited amount of time to complete step 5.

Potential Pros:

  1. It can work offline (if the MFA portal locks a computer or resides on a LAN device without external internet access such as a Synology NAS)
  2. Unlike TOTP, it won't "drift" and require re-sync

Potential Con: It is a relatively complicated process, and it requires that the user fumbles around with two codes

My question is: Why don't services provide this method? (for example DUO or Google Authenticator)

Improve this question

1 Answer 1

Reset to default
0

I guess this isn't a definitive answer, not sure there is one. But food for thought:

In theory this all makes sense. But signatures are based on a hash operation and even MD5 with base64 formatting is 32 characters (assuming no padding by asymmetric algo). That seems pretty rough. One could transmit the hash instead, losing pro 1.

Why not? Maybe because of the aforementioned. Maybe because cloud operators seem to think push notifications are an easier, faster and/or cheaper solution to 2. Physical tokens are already a solution to 1 for cases where the customer doesn't have unlimited cellular bandwidth.

Improve this answer
4
  • That makes sense, but wouldn't it also work if only the first 8 or so characters of the hash were used/confirmed? I know there is more collisions this way, but there is also time limit... More food for thought.
    – Deadbeef Development
    Commented Mar 23, 2022 at 22:36
  • I was also thinking of a QR code
    – Deadbeef Development
    Commented Mar 23, 2022 at 22:37
  • In asymmetric cryptography, the whole signature needs to be transmitted. If the receiver does not have the private key, they have no way to reproduce the signature/verify it. A QR code from the phone to the computer? Certainly possible. Probably not a seamless as the two solutions we have. In short though, there is no documented reason why they don't provide this method. That's the answer to the question. As to whether or not this would work, certainly. But it may not be as seamless as existing solutions.
    – foreverska
    Commented Mar 26, 2022 at 16:16
  • That makes sense. The main reason I asked my question was because I thought there was a security flaw in it. I will mark your answer as the solution.
    – Deadbeef Development
    Commented Mar 31, 2022 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .