Subject: [TLS] one time passwords from private keys

From: Story Henry <[email-masked]>
Date: Sun, 28 Feb 2010 15:58:51 +0100

Hello,

  I am looking around to see if anyone knows an algorithm to allow one to produce a one time password [1] from the private key part of an asymmetric key pair. 

The article "Public-Key Cryptography and Password Protocols"
http://www.cparity.com/projects/AcmClassification/samples/322514.pdf 
shows how to do the inverse.

 The idea is to make it possible to authenticate into any web site using this one time password. The public key would be tied to a WebId/OpenId, following something like the following steps:

1. A server should be able to know for any webId/openid the public key of that id

2. the user will have 
 - the private key
 - using its private key (and perhaps a time stamp, or a nonce from the server, ... ) the user's software would calculate a one time password which the user could then send with its WebId/OpenId to the server

3. the server which gets the openid/webid find the public key securely and use
 that to verify the one time password (somehow)

This would allow us to make it easy to create RESTful authentication for devices with broken (Safari on desktop and iphone) or non existent client side certificates (Android, and most other phones).

For devices with working client side certificates we have foaf+ssl that works reasonably well currently - though we would love the browser vendors to implement user interface improvements. http://esw.w3.org/topic/foaf+ssl

  What we are looking may be impossible. But we can't tell before looking :-)
Also if you know of lists that are open source/open standard spirited that you think I should send this question to, please let me know.

	Henry

[1] http://en.wikipedia.org/wiki/One_time_password
   http://code.google.com/p/mod-authn-otp/wiki/OneTimePasswords

Social Web Architect
http://bblfish.net/

---

From: Ben Laurie <[email-masked]>
Date: Sun, 28 Feb 2010 15:09:17 +0000

On 28 February 2010 14:58, Story Henry <[email-masked]> wrote:

> Hello,
>
>  I am looking around to see if anyone knows an algorithm to allow one to
> produce a one time password [1] from the private key part of an asymmetric
> key pair.
>
>  The idea is to make it possible to authenticate into any web site using
> this one time password. The public key would be tied to a WebId/OpenId,
> following something like the following steps:
>
>  - using its private key (and perhaps a time stamp, or a nonce from the
> server, ... ) the user's software would calculate a one time password which
> the user could then send with its WebId/OpenId to the server
>
> This would allow us to make it easy to create RESTful authentication for
> devices with broken (Safari on desktop and iphone) or non existent client
> side certificates (Android, and most other phones).
>
> For devices with working client side certificates we have foaf+ssl that
> works reasonably well currently - though we would love the browser vendors
> to implement user interface improvements. http://esw.w3.org/topic/foaf+ssl
>
>
> Also if you know of lists that are open source/open standard spirited that
> you think I should send this question to, please let me know.
>

One way of doing what you want is a Schnorr signature. One nice property of
a Schnorr signature is that the private key can easily be derived from a
password, or could just be a random blob. I'm doing some work in this area,
so feel free to contact me offlist if you're interested.

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Ben Laurie <[email-masked]>
Date: Sun, 28 Feb 2010 16:01:58 +0000

> so feel free to contact me offlist if you're interested.

Also, of course, if you have an RSA keypair you could just sign the nonce
with it :-)

---

From: Story Henry <[email-masked]>
Date: Sun, 28 Feb 2010 17:58:11 +0100

> Also, of course, if you have an RSA keypair you could just sign the nonce

Yes, but I think that would make for a string that would be too long for a human being to type into a password field. Such a string should not be more than 5 to 6 characters long.

 So one could use cut and paste on some devices, but until recently that did not work for the iphone for example.

  The best would be of course if phone browsers and others supported TLS, as it did in Fennec
   http://blogs.sun.com/bblfish/entry/foaf_ssl_in_mozilla_s

  And it would be even better if web browsers improved their UI so that one could see what certificate one was logged in with at some web site
   http://blogs.sun.com/bblfish/entry/identity_in_the_browser_firefox
  Because that would allow one to log out using TLS too.

  But to help people who are stuck in bad browser land, we are trying to work on this solution, which won't be any worse than username/passwords - in fact it should be more secure, whilst hopefully giving one one username/passowrd function for all sites.

Henry

---

From: Adam Langley <[email-masked]>
Date: Sun, 28 Feb 2010 12:36:24 -0500

> Yes, but I think that would make for a string that would be too long for a human being to type into a password field. Such a string should not be more than 5 to 6 characters long.

If we assume that the public key is widely known, then an attacker
knows all the information that the legitimate authenticator knows.
Thus the attacker can brute force the password offline, in real time.
A six character password is, roughly, 30-bits. Assuming a 1024-bit
modulus a desktop computer can probably do 2**18 public
operations/sec. A hardware implementation might 100x faster. So it
doesn't take much to brute force that in seconds - faster than you can
expire the nonce because user's only type so quickly.

>  But to help people who are stuck in bad browser land, we are trying to work on this solution, which won't be any worse than username/passwords - in fact it should be more secure, whilst hopefully…

We're aware that Google Chrome is certainly lacking in these respects
on some platforms. It's on the todo list and not too far down.

AGL

-- 
Adam Langley [email-masked] http://www.imperialviolet.org

---

From: Ben Laurie <[email-masked]>
Date: Sun, 28 Feb 2010 17:43:48 +0000

On 28 February 2010 16:58, Story Henry <[email-masked]> wrote:

> Yes, but I think that would make for a string that would be too long for a
> human being to type into a password field. Such a string should not be more
> than 5 to 6 characters long.
>

You didn't mention that it had to be typable!

---

From: Story Henry <[email-masked]>
Date: Sun, 28 Feb 2010 19:49:12 +0100

> expire the nonce because user's only type so quickly.

That is frighteningly fast. 
How many chars does one need then?
And how do 1 time passwords work then at all?

So I suppose the above would not be possible if the client can connect to
the server using https. Most browsers, even when they have broken client
side certificates, do allow https connections - I am guessing this is even true on cell phones. And the server could just tie the response to the TLS session. Does that not remove the above problem?

> on some platforms. It's on the todo list and not too far down.

Great. Also it would be fantastic if one could get the Android platform to support <keygen> and have a good key chain.

A year ago, I had an amazing demo on the iPhone. I could log into to a few of our demo sites without having to type either a username or a password. Pictures of this here:

   http://blogs.sun.com/bblfish/entry/one_click_global_sign_on

But somehow in v3 of the iPhone OS they broke their client certificate stack, and it no longer worked. 

   Henry