Our TAG has a section about the NordicEdge OTP server. This product is now owned by McAfee and: https://kc.mcafee.com/corporate/index?page=content&id=KB85036 "The end of life (EOL) and End of Support (EOS) date for McAfee One Time Password Server version 4.x is July 13, 2016." Thus, this section in the TAG needs to be removed (or replaced with something else).
When it comes to alternatives, it's worth noting that our requirement is using the OTP twice: One time against the master, one time against the agent. Many TOTP implementations allows this. This includes google-authenticator. It allows a "DISALLOW_REUSE" paramter in the config, but apparently it's not there by default. Also, according to this Twitter post, many other implementations also accepts the OTP multiple times: https://twitter.com/jmedwards/status/558561104214102016 "Amazing how many vendors allow reuse of TOTP/2FA codes within time window. Culprits: most banks, Github… At least Google follows the RFC." The RFC does indeed not allow multiple use of the OTP: https://tools.ietf.org/html/rfc6238: Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
(In reply to comment #1) > When it comes to alternatives, it's worth noting that our requirement is using > the OTP twice: One time against the master, one time against the agent. Many > TOTP implementations allows this. This includes google-authenticator. It allows > a "DISALLOW_REUSE" paramter in the config, but apparently it's not there by > default. Also, according to this Twitter post, many other implementations also > accepts the OTP multiple times: > > https://twitter.com/jmedwards/status/558561104214102016 > > "Amazing how many vendors allow reuse of TOTP/2FA codes within time window. > Culprits: most banks, Github… At least Google follows the RFC." > > The RFC does indeed not allow multiple use of the OTP: > > https://tools.ietf.org/html/rfc6238: > > Note that a prover may send the same OTP inside a given time-step > window multiple times to a verifier. The verifier MUST NOT accept > the second attempt of the OTP after the successful validation has > been issued for the first OTP, which ensures one-time only use of an > OTP. Split off to bug 5614.
Added bug 5636 for remove/update of SecurID section.
The TAG looks good, but we still mention NordicEdge in an unsuitable way in the white paper.
PDF version wasn't updated.
PDF looks good now.
