I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a
Device Key asymmetric key is generated and signed using a
User Key asymmetric key.
The user is able to register multiple devices with different
Device keys signed with a unique
So in case of device loss or compromise I want for the user to be able to recover his/her account via a web panel designed for this purpoce. Therefore I thought to keep into the service's database either an email or a phone number during the registration, and via a message to send an One-time authorization code following these steps:
- The user requests account recovery using his email or phone.
- The service sends a message for a temporary link for example the user should be able to click on it in a 1 hour interval.
- Once user clicks on thew link then a OTAC code is sent (OTAC will be also expire after a short time interval as well).
- The user logins to account recovery panel and registers a new device and revokes the access from compromised device.
But how secure is this scheme, are there better schemes offering better balance between security and user experience? Due to password security limitations I want to avoid using a typical username/password and stick to challenge response authentication schemes.
Furthermore what time interval is also good for these type of temporary authentication schemes?