One-time password (OTP) protocols and implementations (software and hardware)

learn more… | top users | synonyms (1)

1
vote
2answers
416 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. ...
1
vote
2answers
31 views

How do hardware OTPs work - from a developer's perspective?

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage). Now I ...
2
votes
3answers
76 views

How do hardware OTPs work?

I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment. Now I know / think to know how OTP works with ...
2
votes
1answer
55 views

Security implications of reusing unused One-Time Password

Scenario: Login to site (using 2SV). One-Time Password (OTP) is sent to client's device. Client won't finish authentication process. On the next day (let's say after 24h) users logins to site again. ...
3
votes
1answer
50 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
3
votes
1answer
71 views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
1
vote
1answer
75 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
1
vote
1answer
53 views

Generation of a shared nonce that cannot be pre computed [closed]

Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
1
vote
1answer
31 views

How big window is secure and practical with TOTP?

We are using Time-based One-time Password Algorithm (Google Authenticator) in our system. Since we currently don't allow any time window and code validity is just 30 seconds, we are constantly having ...
0
votes
2answers
79 views

What is a good way to generate a one time pad, and is this a good way? [duplicate]

Is there a good/better/best way to generate a one time pad? I would like to only utilize about 40 characters (a-z, 0-9, .,!-). What I have come up with is perhaps not the BEST way, but seems to fill ...
2
votes
2answers
65 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
3
votes
0answers
160 views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
1
vote
2answers
139 views

Password Reset URL forwarding

If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link. I have three queries: How to add an expiry date to the ...
8
votes
2answers
209 views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
2
votes
1answer
104 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
2
votes
2answers
237 views

TOTP Resynchronisation

Considering hardware tokens implementing OATH TOTP (c.f. RFC6238), it is common knowledge that the clock in such tokens drift. A token that is not used very often is likely to drift way beyond the ...
4
votes
2answers
221 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
1
vote
1answer
105 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
1
vote
0answers
62 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
4
votes
1answer
119 views

One time password question

Suppose F(X) = (5X) mod 9 is used to generate a one time password. I am supposed to generate the first 8 values using the above formula, starting with the seed value of F(5) Well I know that F(5) = ...
2
votes
1answer
203 views

Lamport OTP system

This might be a stupid question but forgive me. Is the Lamport OTP algorithm different from HOTP and TOTP? How similar or different are they? Thanks in advance
2
votes
1answer
99 views

What happens when authenticating through a phishing attack with FIDO U2F tokens

So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens? Basically, if login just fails, I would assume that the user ...
3
votes
4answers
173 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
2
votes
1answer
116 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
0answers
137 views

Generate secure one-time codes containing information

I need to create a system that allows a user to enter codes to charge an allowance. Embedded in this code should be the amount to charge the allowance. The user would pay for a code which would then ...
12
votes
1answer
858 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
4
votes
4answers
3k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
1
vote
0answers
109 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
1answer
66 views

Implement GPG Verification (Bitcoin-OTC)

I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...
2
votes
2answers
198 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
5
votes
2answers
356 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
1answer
67 views

When, during authentication, should I ask for an OTP token?

I was working on implementing an OTP strategy in our login process of a web application when I was asking myself: Should I ask for the OTP token before or after asking for the username/password? What ...
0
votes
2answers
227 views

Usability of a found OTP Token for my own system [closed]

I found a one-time-password token and am unable to find out who it belongs to or where it has been used. It seems to be manufactured by a company called "ActivIdentity" (now "HID") and called the ...
0
votes
3answers
285 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
-1
votes
1answer
33 views

Double step verification system for homepage

I want to share some of my work with some double step verification system. PGP is not enough, since some of my clients cannot use it. First, you need a password to login but you also need the code ...
3
votes
3answers
267 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
2
votes
1answer
481 views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
0
votes
1answer
118 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
2
votes
0answers
84 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
0
votes
1answer
143 views

find out the algorithm based on some examples?

I have an OTP generator that receive two numbers less than 99 as input and return an 8 digit number as its output. I know it has a simple algorithm. because its processor is just an ATMEGA8 micro ...
1
vote
1answer
148 views

How to cryptoanalyze a one time pad that uses a plain text document as the pad?

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the ...
10
votes
1answer
3k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
79
votes
6answers
21k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
-1
votes
1answer
71 views

Can OTP 2FA be reversibly determined?

Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...
2
votes
4answers
1k views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
0
votes
1answer
229 views

Verification code generation and expiration

I am trying to implement an application that includes registration, In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
0
votes
1answer
404 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
2
votes
1answer
505 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
0
votes
3answers
3k views

Is it possible to use one-time passwords for WI-FI?

Is it possible to configure an access point to use one-time passwords for authentication and encryption ?