​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

Question

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS for token delivery mechanism. But recent recommendation of NIST puts it in RESTRICTED category so this seems risky at the moment for two reasons:

1. As it is in RESTRICTED category, multiple support activities (like risk analysis, methods for situations like phone number portability, device change etc.) needs to be performed for successful compliance with any standard which adapts this framework. NIST says "Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10..."
2. Even if we implement it with cautions, NIST can mark it "forbidden" in near future (they have also mentioned it in paper). So in that case, complete change in method and implementation would be required. Which will definitely cause re-work.

So my problem revolves around these two questions:

1. What can be used as an alternative?
2. OOB token are generally supposed to work on a different band. If we use anything that works on web browser like GAuth would it be OK? In first impression everything (web application and authentication token application) seems to be working on same band.

RSA token are definitely a solution but it is not feasible for us to provide token for thousands of users.

Authenticator app (TOTP) also seems to be a solution but is it the only one? And if it is, what should be taken care of in order to maintain and justify OOB clause?

Please let me know if there is some different interpretation of NIST recommendations or any other aspect?

Answer 1

SMS as a second factor is no longer considered secure due to the ease of spoofing and interception of SMS.

For the most secure MFA, you should be using a device that is separate from any service you are accessing. This is increasingly challenging in a world where people are using phones for everything!

Until recently, many government security agencies would not allow you to use software tokens of any kind which also ruled out any app on a phone. Significant improvements in smartphone security (for some platforms at least) have seen recent changes in that stance and authenticator apps are now commonly used.

Other out-of-band one-time authenticators are also used including email and phone. Of course, each have their own issues and to my mind, the authenticator app remains the best option because at least it tends to be more obvious if the device is lost or stolen.

The one caveat that I would add though is for Android devices. Android should not be considered a secure device without careful choice of the hardware and the addition of security tools to harden the OS.