OATHOAT

OATHOAT is a proposed framework intended to extend the OATH ecosystem by integrating one-time password generation with device attestation to enable interoperable authentication tokens across services. The term has appeared in security discussions as a conceptual approach to combine existing OTP mechanisms (HOTP, TOTP) with cryptographic attestations to verify a user and device before granting access.

In this model, a client device, an authorization server, and a resource server collaborate, with an attestation authority providing device- and configuration-bound evidence. The client proves knowledge of an OTP and presents an attestation. The authorization server validates both elements and issues a short-lived access token (often a JWT) usable at the resource server. The design would typically extend OAuth 2.0 and OpenID Connect with added attestation verification to strengthen assurance of both user and device.

Security and privacy considerations include minimizing data collection, protecting secrets in secure enclaves, preventing phishing by binding tokens to a specific device, and mitigating replay through token lifetimes and audience restrictions. Potential privacy risks involve attestation data and cross-domain token leakage if not properly scoped or controlled.

As of now, OATHOAT is not an official standard. It remains a topic in academic and industry discussions, without formal specification or broad deployment. Realizing it would require coordination among standards bodies, vendors, and privacy and security regimes, as well as clear governance for attestation data and inter-service interoperability.

Related topics include OATH, HOTP, TOTP, OAuth 2.0, OpenID Connect, FIDO2, and device attestation.