V2.9.1 Cryptographic authentication mechanism, protection against disclosure is not relevant

[randomstuff]

Current 2.9.1 (talking about smart cards, FIDO devices):

2.9.1 [MODIFIED, LEVEL L2 > L3] Verify that the authentication server stores the cryptographic keys used in verification are securely and protected against** disclosure**, such as using a Trusted Platform Module (TPM) or Hardware Security Module (HSM), or an OS service that can use this secure storage.

On the authentication server, these credentials are actually public keys. It is therefore not that important to protect them against disclosure. You would not need to store a public key in a TPM or HSM for this usage.

For smart card, these are actually X.509 certificates and protecting them agaisnt disclosure often does not make sense at all.

If I understand this requirement correctly, I think it is not needed.

[tghosth]

Looks like the original NIST requirement was misinterpreted:
https://pages.nist.gov/800-63-3/sp800-63b.html#5172-single-factor-cryptographic-device-verifiers

I would suggest:

"[MODIFIED, LEVEL L2 > L3] Verify that the authentication server stores the cryptographic keys used in verification such that they are protected against modification (and for symmetric keys, against disclosure). This could involve using a Trusted Platform Module (TPM), a Hardware Security Module (HSM), or an OS service that can provide this secure storage."

[tghosth]

@randomstuff what do you think about my proposal?

[randomstuff]

Yes, maybe.

I am wondering how protection about modification should work because it must be possible in some way to modify these credentials.

And we don't have the same requirement (protection against modification) for password hash, do we? Isn't it weird to require protection against modification for these credentials but not some other?

[tghosth]

My guess is that if you can alter this one key then it might lead to widespread compromise whereas if you just modify someone's password that just affects their account.

Again, this is in response to a specific NIST requirement so I think it is ok as it is.

[tghosth]

Any other comments or do you think we can merge this PR?
#2507