Here in Germany, authentication of transactions in online banking (beyond the basic log-in password which is and has always been needed as well) has evolved from a list of one-time passwords which are distributed in advance on paper (so-called "TAN" codes, or transaction authentication numbers) to the use of one-time passwords sent on demand to a mobile phone or similar device, in a message which also contains details of the transfer to authenticate the message. I have been wondering whether it is possible to achieve a similar level of security while still using the older method of distributing a paper list in advance, and in fact came up with a scheme which seems workable to me. Since I am aware of the general quality of security schemes devised by amateurs (and I am an amateur) I would be interested to hear comment on the shortcomings of my scheme from readers of this site.
The basic idea of the scheme is that a paper list of numbered entries would be distributed to the customer in advance by the bank. Instead of containing simple passwords though, the list would contain simple numeric tasks, such as:
Enter the sum of figure one and figure four of the account number, followed by the number eight, followed by sixty minus figure three of the bank sort code.
Enter figure three of the account number, followed by figure two and figure seven of the bank sort code, followed by figure two and figure one of the amount to be transfered (ignoring cents).
When the customer has to authenticate a transaction, they will be given the number of one of the tasks and asked to enter the solution, using the transaction details. It seems to me that this scheme fulfils the requirements that the one-time password generation should be initiated by the bank at the time of the transaction, that it is tied to the transaction, that it is non-trivial to work back from the password to the method used to generated and that it involves a second, separated communication channel. In addition I would hope that it would be manageable for customers (except that it might need a large-ish piece of paper to hold the tasks!), and would actually encourage them to check the transaction details.
I realise that there would need to be requirements on the tasks to keep them usable but still secure, and that they would have to be expressible and parametrisable in a way that the bank's computers can deal with (though new types could be introduced at any time). Beyond that I would be interested to hear what major holes there are in this scheme that I have missed.