0

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume:

  1. Yubikey like devices that have Certs with reasonable expiration dates
  2. The organization has proper certificate revocation mechanisms
  3. Certs provide username and access-role information
  4. Browsers implement mTLS and pass the correct cert

My question is, should I just trust the certificate being passed by the browser and skip typical 'Login' prompts?

I understand a TOTP prompt could enhance this, but would trusting the certificate be a good enough baseline?

Any reference to back up your answers would be appreciated.

Improve this question
2
  • SSO (Single Sign On) means authenticating once with full credentials and then "propagating" this successful authentication when using different services. What you describe has nothing to do with SSO, it is simple authenticating with a client certificate. The full authentication happens with every new TLS connection. But in general: key based authentication like client certificates is sufficient by its own as long as the key is well protected by the client and properly verified by the server.
    – Steffen Ullrich
    Jun 3, 2021 at 13:14
  • @SteffenUllrich as point #4 points out, the browser is sending the cert every request. While not exactly SSO, from a user perspective it's a pretty similar feel. The question is is mTLS without additional authentication accepted as good practice.
    – Liam Kelly
    Jun 3, 2021 at 13:18

2 Answers 2

Reset to default
3

Modern theory of authentication is that a human user should pass a challenge from two (or all three) of the following catagories:

  1. Something you know (ie password)
  2. Something you have (ie yubikey, OTP app, etc)
  3. Something you are (biometric, fingerprint, etc)

Certificate-based mTLS (with a proper CA as you describe) provides a very strong challenge #2, but modern theory probably still recommends a password. If the client prompts for a password to use the certificate on connection (like an SSH key does), then maybe you are meeting this at an organizational level and the server does not need to enforce it.

Improve this answer
3
  • if the yubikey will only use the private key if a PIN/Pass is entered or a fingerprint is read; would it then qualify?
    – Liam Kelly
    Jun 3, 2021 at 14:45
  • 2
    @LiamKelly I would think you could convince an auditor that the user has the yubikey and either knows the PIN or is the fingerprint and therefore you're satisfying two categories with one action. In particular, shoulder-surfing the PIN does not get you anywhere if you don't physically have the yubikey, and conversely stealing the yubikey off someone's desk without knowing the PIN (or being the fingerprint) also does not get you anywhere.
    – Mike Ounsworth
    Jun 3, 2021 at 16:51
  • I figured that would be the case but wanted to make sure I didn't miss something. Thank you!
    – Liam Kelly
    Jun 3, 2021 at 18:41
-1

Mutual TLS connections provide an "AlwaysON" proof of possession. Malicious software can inject data silently if the software has already opened the private key. Two factors as Yubico or another device OTP requires human interaction to validate requests. It prevents attacks in unattended mode. But this raises a question about TOTP in smartphones. It can be stoled by malicious software in the same way. Requesting a PIN to use it will be ok, but you will trust Yubico and the user without control. For example: if the user configures a pin 0000 or uses the Yubico without any pin, you will have a problem. Passwords can be easily revoked, certificates need to be inserted in a CRL. It is much more complex and serialized. Something like passwords with DPOP in a token-based authentication can be your solution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .