32

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ("something you know"). Some of these "second factors" are as simple as providing a piece of paper with either one-time-passwords or information needed to respond to a simple challenge-response protocol. Others range all the way up to “hard” cryptographic tokens which cannot readily be copied. The latter is e.g. required for the NIST 800-63 (Electronic Authentication Guideline) "Level Of Assurance 4" (aka LOA 4).

For example, would a one-time-password via paper meet NIST's "LOA 3" requirements? How about the various recommendations for banking (e.g. FFIEC), or related requirements from other entities?

Improve this question
5
  • I know for a fact that there are still banks in central and eastern Europe that use lists of one time passwords (TANs) as a second login factor or transaction authentication. So at a certain point this method should have been within standard guidelines, they are being phased out though.
    – john
    May 13, 2011 at 23:13
  • @john, that's not saying much - there are some banks that claim to use "Secret Questions" as a 2nd factor...
    – AviD ♦
    May 14, 2011 at 22:28
  • Maybe this is too critical, but typical for whom? In what environment? Typical 'something you have' for a national military organization is likely different from the 'something you have' to login to a corporate VPN.
    – this.josh
    Jun 10, 2011 at 1:42
  • @this.josh Very true. I'm looking for the most authoritative info I can find on how it is defined by the most influential sources: NIST, FFIEC, and whoever else might have one.
    – nealmcb
    Jun 10, 2011 at 18:56
  • I have to link to this: twitter.com/mattblaze/status/792443648520650752
    – kindofwhat
    Oct 31, 2016 at 15:10

4 Answers 4

Reset to default
10

I started to ask this question to get input before discovering the one. In light of a Magistrate Judge's recommended judgement on PATCO v. People's United (which implies a horrible theory regarding multifactor authentication), I define something you have as this:

What you have must only be compromised by an attacker having physical access to what you have. This excludes:

  • A password written on a piece of paper (once somebody sees it, they know it)
  • A cookie stored on your computer
  • "Security questions" (They are just another password)
  • Your PGP key kept on a thumb drive if you plug it into a machine that has network access

That said, I would consider a paper list of 100 passwords that have no relation and are each used only once would be considered something you have. A paper list of 100 passwords that might be asked for more than once would not qualify as an attacker would be able to pretend to have access to that credential by monitoring.

Something you have must be something whose integrity can be secured by physical control. Attacks on the other side of the channel such as stealing their authentication database or breaking a cryptographic protocol don't count. If it can be compromised without an attacker's physical interference (or breaking an encryption algorithm as they are integral to demonstrating possession remotely), it is not something you have. ATM cards are a bit fuzzy that way -- a compromised ATM could provide all the track data, though what we usually see are skimmers (physical access). RSA tokens are another that I would consider something you have.

I like smartcards best because placing them in a reader won't expose their secrets, nor would compromise of the authentication database.

Improve this answer
7
  • 3
    Your conception places considerable restriction on 'something you have' not leaking any information. For example, a cut metal key for a tumbler lock is a traditional 'something you have'. Yet, since the user sees the key they know some attributes of the key: it has five teeth, it is single sided, my key is made by Yale, etc. That information leakage may allow an attacker without access to the physical key to compromise the lock. I believe a thing which meets your definition is very rare.
    – this.josh
    Jun 10, 2011 at 0:38
  • 2
    A key can be secured by physical control. The use of the key does not transmit information (the lock is local), so an attacker's physical interference is required. That meets the standards I defined. That a user can convey all the information about the key, or all the information from a one time password list does not preclude either of them from being something you have. Neither is compromised through their normal usage.
    – Jeff Ferland ♦
    Jun 10, 2011 at 19:16
  • Isn't a password written on a piece of paper as physically controlable as a metal cut key for a tumbler lock?
    – this.josh
    Jun 12, 2011 at 1:00
  • The difference is that a password is transmitted and can be monitored by remote compromise of the computer. A lock does not send details of the key anywhere. Even if you were standing next to me, it would likely be challenging to describe the key without me being complicit. They both present the same risk of physical theft, but different risks of compromise in use.
    – Jeff Ferland ♦
    Jun 12, 2011 at 14:49
  • Passwords are not always transmitted, some are authenticaed locally. Even in enterprise Windows environments credentials are often cached, so not every authentication is transmitted. No one needs to be standing next to a key user. Metal cut keys can be duplicated from photographs take at 195 ft. See Reconsidering Physical Key Secrecy.
    – this.josh
    Jun 12, 2011 at 22:23
8

Re. the question wether a paper based OTP-Solution could fullfill NIST 800-63 Level 3 requirement:

From the source "...

Authentication requires that the claimant prove through a secure authentication protocol that he or she controls the token, and must first unlock the token with a password or biometric, or must also use a password in a secure authentication protocol, to establish two factor authentication. ..."

--> the answer is: Nope! Otoh, this also rules out SMS-based solutions, because nobody can guarantee that the one-time-token cannot be seen without entering a PIN...

Hmm, I guess there will be many foul compromises for that level 3 compliance ... :)

Improve this answer
8
  • 1
    Hmm, this may not be the case, but I'm not sure. The wording of this paragraph is a bit strange, but pay attention to the 'or' part. First of all the claimant must prove that he is in control of the token. This is a requirement for every level, even the 1st. The added thing on the level 3 is that he must either use a pin to unlock the token, or use a pin while doing the authentication as a second factor. At least this is how I interpret that paragraph.
    – john
    May 15, 2011 at 15:12
  • 1
    I just found a very interesting paper on the subject of NIST Levels and mobile phones: ida.liu.se/~annva/papers/… On section 3 they evaluate severl factors and propose ways to make mobilel phones compliant with different levels. As I read, if certain assumptions hold and can be implemented, Level 3 compliance could be achieved. To sum up, in the usual case, it turns out you are correct: Mobile phones and lists of one-time-passwords are certainly not Level 3 compliant.
    – john
    May 15, 2011 at 16:27
  • 1
    Interesting that after the RSA incident there was a lot people and a fair few self interested vendors writing about the advantages of SMS OTP or soft token on mobile over a hard token mainly due to the ability to quickly update. I have 3 hard tokens on my key chain 2 from banks, one from employer none of them require a pin to see the OTP. Only work one requires pin with OTP to use. On the other hand my iPhone has a strong password to secure SMS OTP and soft token. If Google and Apple make a pin mandatory would that change your mind @kindofwhat ?
    – Rakkhi
    May 16, 2011 at 14:44
  • 2
    Great conversation, @kindofwhat, @john, @rakkhi! Can we get it edited into the answer, which we seem to agree is a bit off-track now with its reasoning?
    – nealmcb
    May 16, 2011 at 17:21
  • 1
    SMS is not a 2nd factor, but it is out-of-band, and that has a different set of benefits. But no, it is definitely not a 2nd factor.
    – AviD ♦
    May 18, 2011 at 9:36
5

Two-factor authentication is a part of the larger family of Multi-factor authentication. This is the defense in depth approach of "Security In Layers" applied to authentication.

Two-factor authentication is not only just "something you have". Choosing any two from these three categories of authentication would be Two-Factor:

  • Something the user knows (e.g., password, PIN, SSN);

  • Something the user has (e.g., ATM card, smart card, Key Fob, RFID); and

  • Something the user is (e.g., biometric characteristic, such as a fingerprint, iris scan).

Two-factor authentication is also common in the non-technical world. Such as having to show your picture id with a credit card purchase. The credit card is what you have and another person can link the name on the card to the face on the drives license with the buyer.

Improve this answer
4
  • +1, even though this answer no longer fits the edited question (it did before, though, so thats why the upclick...)
    – AviD ♦
    May 14, 2011 at 22:30
  • 1
    @AviD♦ haha, and now he is linking to the wiki article I modified. Oah internets, how I love thee.
    – rook
    May 15, 2011 at 1:14
  • I'm sorry my title originally didn't capture the core of my question, as @scott pointed out on chat. I certainly thought it was useful to give folks a wiki reference. I'm not sure I follow your comment about the internets. We probably could use another question on general multi-factor definitions or issues.
    – nealmcb
    May 15, 2011 at 5:58
  • @nealmcb I modified the wiki link you are pointing to to contain information that I posted here. But you might have gotten a better answer if you just re-posted.
    – rook
    May 15, 2011 at 16:23
-2

My own opinion, but I think "something you have" should have the following characteristics:

  • the user can easily and immediately detect its absence
  • it can be rendered ineffective by the issuing authority without requiring possession
  • possession proves identity

A hardware token would fit these requirements, a one time password would not.

Improve this answer
7
  • I agree with the first two. But "possession proves identity" is too dangerous. It should also require a PIN or be used in conjunction with a password or other factor.
    – nealmcb
    May 15, 2011 at 5:47
  • @nealmcb you're right, that was the intention with possession proves identity, you want a strong binding capability, something that demonstrates you truly possess it (like a PIN)
    – Ben
    May 15, 2011 at 14:27
  • @Ben why a one-time password would not fit these 3 requirements you state? (and what do you mean by one time password, beacause it can be argued that hardware tokens produce exactly such passwords)
    – john
    May 15, 2011 at 15:37
  • @john I was referencing @nealmcb password on paper concept. I can easily remove the paper from the user's wallet, copy the password (memorize it, take a picture, write it down etc...) and replace the paper in the wallet. The user is unaware of its absence, specifically that two copies can exist and be equally usable.
    – Ben
    May 15, 2011 at 16:44
  • 1
    Absence is quite different from non-existence of a copy. Requiring a PIN transforms a token into a 2-factor device, which is broader than just "something you have"
    – nealmcb
    May 15, 2011 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .