Performing client authentication using onetime values recovered from barcode graphics

A computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for authenticating a user requesting access to a computing resource, the operation comprising:

• in response to receiving a request to access the computing application:
• encrypting a first nonce using a public key associated with the user, and
• encoding the encrypted nonce in a barcode graphic;
• sending the barcode graphic to the client device as a second factor authentication challenge;
• receiving, from the client device, a response to the challenge which includes a second nonce;
• and
• upon determining the second nonce matches the first nonce, granting the client device access to the computing application.

A system, comprising:

• a processor;
• and
• a memory hosting an application, which, when executed on the processor, performs an operation for authenticating a user requesting access to a computing resource, the operation comprising:
• in response to receiving a request to access the computing application:
• encrypting a first nonce using a public key associated with the user;
• and
• encoding the encrypted nonce in a barcode graphic,
• sending the barcode graphic to the client device as a second factor authentication challenge,
• receiving, from the client device, a response to the challenge which includes a second nonce, and
• upon determining the second nonce matches the first nonce, granting the client device access to the computing application.

A method for accessing a computing resource hosted by a network accessible computing system, the method comprising:

• scanning, by a mobile device, a barcode graphic to recover an encrypted nonce;
• decrypting the encrypted nonce with the a private key retrieved from a certificate store on the mobile device;
• and
• displaying, as a one-time password, the decrypted once.

A computer-readable storage medium storing instructions, which, when executed on a processor on a mobile device, performs an operation for responding to an authentication challenge, the operation comprising:

• scanning, by a mobile device, a barcode graphic to recover an encrypted nonce;
• decrypting the encrypted nonce with the a private key retrieved from a certificate store on the mobile device;
• and
• displaying, as a one-time password, the decrypted once.