Subject: [kitten] U2F/FIDO/WebAuthn in draft-ietf-kitten-scram-2fa-01

From: Simon Josefsson <[email-masked]>
Date: Tue, 08 Feb 2022 11:59:04 +0100

I think the document should discuss how U2F/FIDO/WebAuthn would be
supported, since that is (to my knowledge) the best recommended openly
standardized 2fa protocol available.  What do you think?

OATH HOTP/TOTP was superseded as the best recommended choice 5+ years
ago when U2F became available.

Alternatively, perhaps this document should specify a SCRAM-TOTP variant
only, and not allow sub-protocol flexibility, to reduce the number of
sub-negotitations we have in popular SASL mechanisms.  Sub-negotiation
within a SASL mechanism seems to be one major reason why SASL mechanisms
fail as far as I can judge.

/Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 10 Feb 2022 14:41:39 +0000

Hi Simon,

> ago when U2F became available.
Ok, let me study relevant documents and I will reply to your proposal at 
a later time.
> fail as far as I can judge.

I generally don't mind having a single recommended (or maybe 2) 2FA 
mechanisms, but I would like the design of SCRAM 2FA to be extensible in 
case we need to change the 2FA mechanism later on.

Best Regards,

Alexey