The Electronic Secure Authentication (ESAT) TC [1] has approved submitting Secure QR Code Authentication Version 1.0 to the members of OASIS as a candidate for OASIS Standard.
The specification describes the use of QR Codes and a mobile phone as a replacement for a username and password in user login authentication. An alternative to passwords that includes QR Codes is described, and typical use cases are described. This document also provides an overview and context for using QR Codes for security purposes.
In addition, the document specifies a "Secure QR Code Authentication Protocol" (SQRAP) and assesses the related security threats and risks.
The TC has received 3 Statements of Use from HYPR, Trusona, and CVS.[2].
This is a call to the Organizational Members of OASIS to consent or object to this approval. You are welcome to register your consent explicitly on the ballot; however your consent is assumed unless you register an objection [3]. To register an objection, you must:
1. Indicate your objection on this ballot, and
2. Provide a reason for your objection and/or a proposed remedy to the TC.
You may provide the reason in the comment box or by email to the Technical Committee on its comment mailing list or, if you are a member of the TC, to the TC's mailing list [4]. If you provide your reason by email, please indicate in the subject line that this is in regard to the Call for Consent. Note that failing to provide a reason and/or remedy may result in an objection being deemed invalid.
URIs:
The Committee Specification is available here:
Secure QR Code Authentication Version 1.0
Committee Specification 01
01 July 2022
Editable source (Authoritative):
https://docs.oasis-open.org/esat/sqrap/v1.0/cs01/sqrap-v1.0-cs01.docx
HTML:
https://docs.oasis-open.org/esat/sqrap/v1.0/cs01/sqrap-v1.0-cs01.html
PDF:
https://docs.oasis-open.org/esat/sqrap/v1.0/cs01/sqrap-v1.0-cs01.pdf
For your convenience, OASIS provides a complete package of the specification document and any related files in ZIP distribution files. You can download the ZIP file at:
http://docs.oasis-open.org/esat/sqrap/v1.0/cs01/sqrap-v1.0-cs01.zip
Please contact OASIS TC Administration at tc-admin@lists.oasis-open.org with any questions you may have about this ballot.
--- Additional information ---
[1] Electronic Secure Authentication (ESAT) TC
https://www.oasis-open.org/committees/esat/
[2] Statements of use
- HYPR:
https://www.oasis-open.org/apps/org/workgroup/esat/email/archives/202207/msg00001.html
- Trusona:
https://www.oasis-open.org/apps/org/workgroup/esat/email/archives/202207/msg00000.html
- CVS:
https://www.oasis-open.org/apps/org/workgroup/esat/email/archives/202206/msg00009.html
[3] https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26#OScallForConsent
[4] Comments may be submitted to the TC through the use of the OASIS TC Comment Facility as explained in the instructions located at https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=esat
Comments submitted to the TC are publicly archived and can be viewed at https://lists.oasis-open.org/archives/esat-comment/
Members of the TC should send comments directly to esat@lists.oasis-open.org. |
