In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS for token delivery mechanism. But recent recommendation of NIST puts it in RESTRICTED category so this seems risky at the moment for two reasons:
- As it is in RESTRICTED category, multiple support activities (like risk analysis, methods for situations like phone number portability, device change etc.) needs to be performed for successful compliance with any standard which adapts this framework. NIST says "Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10..."
- Even if we implement it with cautions, NIST can mark it "forbidden" in near future (they have also mentioned it in paper). So in that case, complete change in method and implementation would be required. Which will definitely cause re-work.
So my problem revolves around these two questions:
- What can be used as an alternative?
- OOB token are generally supposed to work on a different band. If we use anything that works on web browser like GAuth would it be OK? In first impression everything (web application and authentication token application) seems to be working on same band.
RSA token are definitely a solution but it is not feasible for us to provide token for thousands of users.
Authenticator app (TOTP) also seems to be a solution but is it the only one? And if it is, what should be taken care of in order to maintain and justify OOB clause?
Please let me know if there is some different interpretation of NIST recommendations or any other aspect?