Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones.

The problem we're starting to face is when new clients wants us to use the same app for a soft token already used by others.

What's the security reason that one user can't have multiple profiles on the same smartphone to provide soft tokens based on a client basis?

  • This is a limitation of the token client software. RSA and VIP both use shared secret crpyto, but there is no reason that they cannot securly manage more than one shared secret per token without sharing secrets. (Disc: I work for a competitor.) – nowen Jan 27 '15 at 15:10
  • @TildalWave The question isn't about sharing the device with someone else, but a single person replacing multiple hardware tokens with multiple profiles for different soft tokens on one device. – Xander Jan 27 '15 at 18:50
  • @TildalWave Thanks for the CT-KIP document. From section 3.2: "Device will host an application communicating with the CT-KIP server as well as the cryptographic token, and collectively, the cryptographic token and the communicating application form the CT-KIP client." Is it a functional limitation that the app can't host multiple profiles each communicating with a different CT-KIP server? Or this is related to the device identifier having to be unique. – Fadel Jan 28 '15 at 1:23
  • 2
    @TildalWave I've slightly updated the question to refelct a single user case. For example i've got RSA SecurID on my iPhone, with client X and client Y both using RSA tokens. So the question would be about having two profiles imported into the app, where each profile provides a token for the specific client. – Fadel Jan 28 '15 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.