New schema https not supported

[agowa]

Hi,

apparently RSA has a now schema for the QR-Code/Links. Instead of http://127.0.0.1/securid/ctf?ctfData= it's now http://127.0.0.1/securid/ctf?schema=https&url=<<<FQDN>>>:443/ctkip/services/CtkipService
and it also requires an additional activation ID.

According to the verbose logs (that the RSA app thanksfully automatically enables for the first imported token) it does:

1. Check for non default CAs in trust store android keystore is not null and ssl factory trust all cerificates = false
2. Connect to the url using the schema from the above url.
3. Verify the TLS context (protocol, cipher suite, peer host) and also check something it calls "allowed endPoints", probably to see if it got redirected or not?
4. Response is logged as "send helo message"
5. Logs something about encrypting a block and being FIPS140Compliant
6. "startNewTokenRequest" second round
7. Sends another request to the same endpoint (I assume containing the encrypted block from before)
8. Response is logged as "send finish message"
9. calculateCMAC
10. getPinHandling (assuming certificate pinning to error out when the request was MITMed?)
11. "device compliance is required" (probably root detection as listed in the feature set of their app)
12. validateToken
13. "import ctkip token done with next serial number: <<12 digit decimal serial number>>

When googling for documentation from RSA I also stumbled across this project: https://github.com/dlenski/rsa_ct_kip

Edit: Also important note, the QR-Code/Link is valid only once. You can't use it multiple times, not even on the intended device (the server will deny your request with an error claiming the Activation code is invalid)

[frankspace]

Based on the contributors cited at the rsa_ct_kip link, @cemeyer, @rgerganov, @cernekee, @sorenisanerd is there any possibility of stoken being updated? It looks like this is about to become a problem.