Jump to content

Draft:X.1280: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
undoBaker232 (talk | contribs)
97 edits
Content deleted Content added
VisualWikitext
Baker232 (talk | contribs)
97 edits
No edit summary
Baker232 (talk | contribs)
97 edits
Submitting using AfC-submit-wizard
Line 1: Line 1:
⚫
{{Short description|Standard defining the framework for out-of-band server authentication (ITU-T X.1280)}}
{{Draft topics|software|computing|technology}}
{{AfC topic|stem}}
{{AfC submission|||ts=20251106115711|u=Baker232|ns=118}}
{{AFC submission|d|v|u=Baker232|ns=118|decliner=ToadetteEdit|declinets=20250521073843|ts=20250516060341}} <!-- Do not remove this line! -->
{{AFC submission|d|v|u=Baker232|ns=118|decliner=ToadetteEdit|declinets=20250521073843|ts=20250516060341}} <!-- Do not remove this line! -->
{{AFC submission|d|adv|u=Baker232|ns=118|decliner=Caleb Stanford|declinets=20250510200235|small=yes|ts=20250422004206}} <!-- Do not remove this line! -->
{{AFC submission|d|adv|u=Baker232|ns=118|decliner=Caleb Stanford|declinets=20250510200235|small=yes|ts=20250422004206}} <!-- Do not remove this line! -->


⚫
{{Short description|Standard defining the framework for out-of-band server authentication (ITU-T X.1280)}} {{Draft topics|software|computing|technology}} {{AfC topic|stem}}


{{Draft article}} {{Infobox technology standard | title = X.1280 | long_name = Framework for out-of-band server authentication using mobile devices | image = | caption = | status = In force (Recommendation) | year_started = 2022 | version = 1.0 | version_date = {{Start date and age|2024|03|01}} | preview = | preview_date = | organization = [[ITU-T]] | committee = [[ITU-T Study Group 17]] | base_standards = | related_standards = [[X.509]], [[X.1254]] | abbreviation = | domain = [[Cybersecurity]],
{{Draft article}} {{Infobox technology standard | title = X.1280 | long_name = Framework for out-of-band server authentication using mobile devices | image = | caption = | status = In force (Recommendation) | year_started = 2022 | version = 1.0 | version_date = {{Start date and age|2024|03|01}} | preview = | preview_date = | organization = [[ITU-T]] | committee = [[ITU-T Study Group 17]] | base_standards = | related_standards = [[X.509]], [[X.1254]] | abbreviation = | domain = [[Cybersecurity]],

Revision as of 11:57, 6 November 2025


X.1280
Framework for out-of-band server authentication using mobile devices
StatusIn force (Recommendation)
Year started2022
Latest version1.0
March 1, 2024; 20 months ago (2024-03-01)
OrganizationITU-T
CommitteeITU-T Study Group 17
SeriesX
Related standardsX.509, X.1254
DomainCybersecurity,


Identity management,


Authentication,


Phishing resistance
Websitehandle.itu.int/11.1002/1000/15661

ITU-T X.1280 is an international standard from the ITU-T that defines a framework for server authentication using an out-of-band (OOB) mobile device channel.[1][2] The standard (Recommendation), approved in March 2024, was developed based on technology originating from South Korea.[1][3]

The primary goal of this recommendation is to address the verifier impersonation vulnerability—such as phishing or pharming sites—found in traditional authentication methods.[1][2][4] A central principle of this framework is the implementation of a mutual authentication procedure.[2] This procedure requires explicit user verification of the server's legitimacy before submitting authentication credentials, such as passwords.[2][3]

The framework enhances traditional authentication by having the user actively authenticate the server's identity at the start of the process.[4] This user-first verification helps reduce vulnerabilities such as terminal dependency (seen in some PKI-based methods) and verifier impersonation, which are commonly exploited in conventional authentication schemes.[2][3]

Principle

The core of the X.1280 framework is a user-driven comparison of a "Server Authentication Information" code, which is generated simultaneously on two different channels.[2][3] This process is designed to ensure the user is interacting with the legitimate server before any sensitive information is exchanged.[2]

Code Generation and Comparison

The primary mechanism is a multi-step process:

Request and Offset Generation: When a user attempts to log in, the authentication system (Verifier) generates a dynamic, session-specific "offset" value. This offset can include data like session ID, IP address, and timestamp.[2]

Dual Calculation:

Server-side (In-band): The Verifier uses a pre-shared verification key and the new offset to calculate a one-time "Server Authentication Information" code. This code is then displayed to the user on their terminal (e.g., PC browser).[3][2]

Client-side (Out-of-band): The Verifier sends the offset value only to the user's registered mobile device via a separate channel (like a push notification). The mobile authenticator app, which already holds the same verification key, performs the same calculation using the key and the received offset to generate its own code.[2][3]

Visual Comparison by User: The user is presented with two codes: one on their login terminal (in-band) and one on their mobile authenticator (out-of-band).[1][2]

Server Authentication: The user visually compares the two codes. If they match, the user confirms the server's legitimacy by tapping "Approve" on the mobile app. This action verifies the Verifier's authenticity and then allows the user authentication step (such as submitting a PIN or biometric on the phone) to proceed.[2][3]

This method uses a challenge–response one-time password (OTP) algorithm, where the offset acts as the dynamic challenge.[2]

  1. ^ a b c d "'모바일 OOB 서버인증' ITU-T 국제표준 채택... "파밍·피싱 차단"" (in Korean). 보안뉴스 (BoanNews). 2024-03-27. Retrieved 2025-11-06.
  2. ^ a b c d e f g h i j k l m "피싱 공격을 막는 새로운 인증 표준, ITU-T X.1280" (in Korean). AhnLab. 2024-05-10. Retrieved 2025-11-06.
  3. ^ a b c d e f g "이에스이, '모바일 OOB 서버인증' 기술...ITU-T 국제표준 채택" (in Korean). 데일리시큐 (DailySecu). 2024-03-27. Retrieved 2025-11-06.
  4. ^ a b "ITU-T X.1280 국제표준, 피싱 및 파밍 공격 방어의 새 지평 열어" (in Korean). CISO Korea. 2024-07-29. Retrieved 2025-11-06.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Draft:X.1280&oldid=1320728049"