helloworld1
Feature request: "NIST Mode" -- marry a key to the device
Right now, the app is not usable (at least, not licitly usable) in any FIPS-140-compliant system.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf
5.1.4.1 Single-Factor OTP Authenticators
Single-factor OTP authenticators contain two persistent values. The first is a symmetric key that persists for the device’s lifetime. The second is a nonce that is either changed each time the authenticator is used or is based on a real-time clock.
…OTP authenticators — particularly software-based OTP generators — SHOULD discourage and SHALL NOT facilitate the cloning of the secret key onto multiple devices.
Therefore, being able to dump the shared secret off a rooted phone still squeaks by, but a straight-up "export" feature that facilitates decoupling the key from the phone disqualifies it.
Is this something you'd be interested in adding support for -- a separate "NIST Mode" that, say, stores the secret against the phone's HSM (and/or does the calculations in an enclave) to allow the app to be usable in corporate contexts?
Thanks for the suggestion. I don't currently have bandwidth to do it since it is rather complicated. I am open to any contribution if there are more interest to secure the app.
