No, I wasn’t thinking of separate
protocols within this scope, just means to carry the data that relate to a
particular OTP-based authentication request in a token along with the OTP value
to which they correspond.
--jl
From: Anthony Nadalin
[mailto:]
Sent: Tuesday, September 20, 2005
2:08 PM
To: Linn, John
Cc: Granqvist, Hans;
Subject: RE: [wss] WSS OTP-Token
subcommittee proposal
Is the scope of this to also be defining protocols for
obtaining various ancillary information (e.g., PINs, challenges, counters,
identification of specific devices instead of or along with named users, OTP
generation algorithm identifiers, device resynchronization facilities) ?
Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122
"Linn,
John" <>
"Linn,
John" <>
09/20/2005 12:42 PM
To
Anthony
Nadalin/Austin/IBM@IBMUS, "Granqvist, Hans"
<>
cc
<>
Subject
RE: [wss] WSS
OTP-Token subcommittee proposal
I’ll comment here from the perspective of the RSA/OTPS work and
potential submission. We’re not proposing to submit a technology in the sense
of a particular OTP method, but rather of a candidate OTP profile description
that is intended to be method-neutral and able to support authenticator devices
operating in time-based, counter-based, and/or challenge-response modes. If and
as this is contributed into OASIS and related work is progressed there, I would
expect any references within the resulting OASIS work to be non-normative.
The
question of adopting UsernameToken for this purpose is a good one. When we
started investigating technical approaches for integrating OTPs as a means to
authenticate WSS requests, this was just the approach we had in mind. On
further consideration, however, we identified needs to represent various
ancillary information (e.g., PINs, challenges, counters, identification of
specific devices instead of or along with named users, OTP generation algorithm
identifiers, device resynchronization facilities) in order to provide
comprehensive support for OTP-based methods. This suggested an approach which
draws from and adapts concepts introduced in UsernameToken, but it wasn’t clear
how this ancillary data would be appropriately represented within UsernameToken
as written.
--jl
From: Anthony Nadalin [mailto:]
Sent: Tuesday, September 20, 2005 12:36 PM
To: Granqvist, Hans
Cc: Linn, John;
Subject: Re: [wss] WSS OTP-Token subcommittee proposal
The
proposal below list 2 technologies, I assume that these technologies would not
be part of the submission but non normative references ? Also is there a way
that the UsernameToken profile be adopted to accommodate as there is a lot of
overlap here.
Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122
"Granqvist, Hans"
<>
"Granqvist,
Hans" <>
08/22/2005 06:53 PM
To
<>, "Linn, John"
<>
cc
Subject
[wss] WSS OTP-Token subcommittee proposal
(This is a follow up to the issue I brought up August 9
regarding a WSS One-Time Password token profile sub
committee, see minutes of call under "5. Other business"
--Hans)
Proposal
========
RSA Security and VeriSign would like to propose a new work
item for the WSS TC, defining a WSS profile for use of One-
Time Password (OTP) authentication. The intended goal is
to accommodate a broad range of OTP technologies within the
WSS framework. While IPR claims may apply to underlying OTP
methods that the profile may support, the proposers intend
that the constructions to be defined in the profile itself
be unencumbered.
This profile would be functionally comparable to other
profiles defined within the WSS TC, so we believe it is
appropriate to standardize within the same forum. We
propose that this work item be pursued in a new OTP Token
Profile subcommittee within the WSS TC, as this should
facilitate effective discussion of OTP-related aspects that
may have limited interest for some TC members. The profile
specification(s) would be the subcommittee's deliverable to
the TC. A chair or co-chairs would be selected if and as the
subcommittee is formed.
We anticipate that existing and related work will be
available as input for this task. The One-Time Password
Specifications (OTPS, http://www.rsasecurity.com/rsalabs/otps)
initiative, coordinated by RSA Security, has produced several
drafts of an OTP-WSS-Token specification which have evolved
in response to public review and comment. Following further
refinement within the OTPS process, RSA Security proposes to
submit a subsequent version of this document as input to the
WSS TC.
VeriSign, in conjunction with the Open Authentication
initiative (OATH, http://www.openauthentication.org) is also
producing work related to an OTP token profile. We anticipate
that versions of these input documents will be ready for OASIS
submission by or during October 2005. We propose that the
results of these efforts, along with any other inputs which may
be received through the OASIS process, be harmonized under WSS
TC auspices.
John Linn, RSA Security
Hans Granqvist, VeriSign
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. You may a link to this group and all your TCs in OASIS
at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php
