Implementing one-time password as a 2FA

[11037luna]

As discussed the other day in #1344, I've been thinking about how to implement this new authentication factor.

Currently, I'm looking to implement OTP email-based only. For ease of writing and reading, I'll use the term "OTP" to refer to "HMAC-based one-time password".

Time-based one-time passwords (TOTP) are less secure and more difficult for the end users to use, so I don't intend to implement it (at least for now).
I don't like the idea of sharing the secret with the user. I also don't like the idea of keeping the same secret. The user will probably store their TOTP secret in the same place as their password, so it's just an extra step to log in without adding much security.

This discussion only applies to the implementation of the code when the OTP feature is enabled in the configuration or environment (using the HOTP_ENABLE or [hmac_otp]). The current logic should remain unchanged if the feature is disabled.

---

Currently, I'm thinking about how Rauthy should handle OTP with different account configurations.
When configuring the MFA, I'm considering the following:

Password account without a passkey or OTP:

1. user can register a first passkey.
2. user can activate OTP.

In both cases, the user must use their password to make changes.
(Currently, this is the default behavior.)

Password account with passkey and no OTP:

1. user can manage their passkeys (add/edit/remove).
2. user can activate OTP.

In both cases, the user must use one of their passkeys to make changes.
(Currently, this is the default behavior.)

Password account without passkey and with OTP:

1. user can register a first passkey.
2. user can deactivate OTP.

In both cases, the user must provide an OTP code to make changes.

Password account with passkey and OTP:

1. user can manage their passkeys (add/edit/remove).
2. user can deactivate OTP.

In the first case, the user must use one of their passkeys.
In the second case, the user must provide an OTP code.
Should we also allow the user to manage their passkeys with an OTP code? And deactivate OTP with their passkeys?

--

Passkey account without OTP:

1. user can manage their passkeys (add/edit/remove).
2. user can activate OTP.

In both cases, the user must use one of their passkeys to make changes.
(Currently, this is the default behavior.)

Passkey account with OTP:

1. user can manage their passkeys (add/edit/remove).
2. user can deactivate OTP.

In the first case, the user must use one of their passkeys AND (OR?) provide an OTP code.
In the second case, the user must provide an OTP code.

---

When logging in, I'm considering the following:

For a password accounts with both a passkey and an OTP, users can choose which 2FA method to use when logging in.
For a passkey account with OTP, the OTP is an additional 2FA that must be used after the passkey. The user must provide both.

---

Of course, this assumes that the user has a valid and verified email address.

If you have any feedback about this, please feel free to share your thoughts.

[sebadob]

Should we also allow the user to manage their passkeys with an OTP code? And deactivate OTP with their passkeys?

This one is tricky. Passkeys are much stronger, and if we would allow modifying Passkeys with an OTP code, it would basically reduce their security to the one of OTPs. However, the same is true for logins, when a user has Passkeys + OTP configured. In this case, Passkeys are not a real security boost (OTP is the weaker link), but it provides a better UX at least.

I think, when a user has both anyway already, and therefore no security advantage, "any form of 2FA" is good enough to make modifications.

Passkey account with OTP

This is a bit of a werid combination. I would say the requirements depend on the client config. If mfa is enforced, a Passkey must be given in addition, because it's impossible to know for Rauthy if the users E-Mail acc is actually 2FA / MFA secured. In all other situations, the OTP from E-Mail can be seen as the 2nd factor though.

For a passkey account with OTP, the OTP is an additional 2FA that must be used after the passkey. The user must provide both.

I would do it the other way around. If the user decides to only log in via OTP, the Passkey must be provided as the 2nd factor if the current login requires it. Passkeys are by far the strongest option and have built-in 2FA (at least), as long as the UV flag is set. A future Rauthy version will come with a config option to always require UV. Currently, it's optional. Only if it's a non-UV'ed Passkey and the login required 2FA, then I would request an additional OTP via E-Mail.

---

The biggest problem with E-Mail OTPs is that Rauthy cannot know how well the email acc is secured. If it's for instance only secured with a password, it would basically degrade Rauthys login security level to password only as well for this user. However, TOTP have a similar issue. They are only a bit more secure when they are actuallay generated on different hardware. But, this is impossible to know and verify.