GSA OGP - Phishing Resistant Authenticator - MRAS

The General Services Administration (GSA), in collaboration with the Office of Government-wide Policy (OGP) and the Federal Acquisition Service, is undertaking a market research initiative focused on Post-Quantum Cryptography (PQC). This effort is spearheaded by the Federal Identity and Cybersecurity (FICS) Division, which aims to develop criteria for identifying vendor products that are resistant to phishing attacks. The overarching goal of this initiative is to support federal agencies in replacing outdated authentication methods with more secure, phishing-resistant or passwordless alternatives. This aligns with guidelines outlined in OMB Memo 22-09, emphasizing the need for robust cybersecurity measures across government operations.

The primary focus of this research is on Phishing Resistant Authenticator Products. These products must be fully functional and secure, capable of interoperating across various platform technologies. Key concerns addressed include vulnerabilities such as credential replay attacks, push bombing through notifications, SS7 protocol weaknesses in SMS one-time pins, and SIM swap attacks. The GSA's objective is to gather comprehensive information on existing industry capabilities and products that can effectively mitigate these threats.

Through this Request for Information (RFI), GSA seeks detailed descriptions of available products that meet these stringent security requirements. This market research will inform future acquisition strategies by providing a clearer understanding of the industry's current offerings related to Phishing Resistant Authenticator Products. By doing so, it aims to enhance the security infrastructure within federal agencies by ensuring access to cutting-edge authentication technologies.