Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys.
Machine-to-machine connections between services. During a connection, the client (connection initiator) should be able to enable multiple privileges/capabilities by proving possession of the corresponding key for each.
End nodes will be preconfigured to trust incoming connections from the manufacturer, but the local administrator is able to modify the configuration of his own node. As a consequence (this is not necessarily a requirement) the local administrator can remove the manufacturer's public keys and replace them with his own. The local administrator must NOT be able to read any secrets that would allow him to impersonate the manufacturer to connect to endpoints elsewhere on the WAN. That's why asymmetric encryption is chosen rather than pre-shared keys.
As an unimportant detail, the actual connections are websockets. TLS will be provided for remote connections by a proxy server; there are also LAN connections within each installation to the same endpoint and for these the overhead of TLS is not desired. Also, management is easier if capabilities can be individually unlocked in sequence instead of predefining roles at the server endpoint. As well, some non-sensitive data needs to be transferred prior to the authentication step taking place.
MitM attacks and management of the private keys at the manufacturer node (including countermeasures such as key expiration and revocation) are out of scope.
I've researched these but none of seems to be a perfect fit:
- SASL and particularly LDAP public-key authentication RFC 3163 -- perfect fit but apparently abandoned due to flaws
- SCRAM RFC 5802 -- uses challenge response to avoid transmitting the shared secret, but still requires a preshared secret aka password
- SSH RFC 4252 -- ideal authentication and key management but integrated with tunnel encryption
- TLS RFC 4346, 5246, 8446 -- strong authentication but overly complex key management, and integrated with tunnel encryption
Also this page describes Encrypt-then-MAC as having better proofs of security properties than Encrypt&MAC or MAC-then-Encrypt, however I think this distinction likely doesn't apply to authentication that is layered separately from encryption.
Please recommend an existing design so I am not choosing nonce, padding, and hash iteration policies myself!
Even better if an implementation is included in the .NET Framework.