search

helloworld1 / FreeOTPPlus

Enhanced fork of FreeOTP-Android providing a feature-rich 2FA authenticator
Apache License 2.0
648 stars 75 forks source link

Feature request: "NIST Mode" -- marry a key to the device #132

Open James-E-A opened 3 years ago

James-E-A commented 3 years ago

Right now, the app is not usable (at least, not licitly usable) in any FIPS-140-compliant system.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf

5.1.4.1 Single-Factor OTP Authenticators

Single-factor OTP authenticators contain two persistent values. The first is a symmetric key that persists for the device’s lifetime. The second is a nonce that is either changed each time the authenticator is used or is based on a real-time clock.

…OTP authenticators — particularly software-based OTP generators — SHOULD discourage and SHALL NOT facilitate the cloning of the secret key onto multiple devices.

Therefore, being able to dump the shared secret off a rooted phone still squeaks by, but a straight-up "export" feature that facilitates decoupling the key from the phone disqualifies it.

Is this something you'd be interested in adding support for -- a separate "NIST Mode" that, say, stores the secret against the phone's HSM (and/or does the calculations in an enclave) to allow the app to be usable in corporate contexts?

helloworld1 commented 3 years ago

Thanks for the suggestion. I don't currently have bandwidth to do it since it is rather complicated. I am open to any contribution if there are more interest to secure the app.