One-time password (OTP) protocols and implementations (software and hardware)

learn more… | top users | synonyms (1)

77
votes
3answers
26k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
42
votes
4answers
13k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
12
votes
1answer
709 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
11
votes
3answers
1k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
10
votes
4answers
942 views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
10
votes
2answers
2k views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
7
votes
2answers
800 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
7
votes
2answers
1k views

How to store OTP seed securely at the validating server

'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm. Most OTP (One Time Password) solutions are based on ...
7
votes
1answer
1k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
7
votes
1answer
987 views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
6
votes
1answer
266 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
6
votes
1answer
280 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
6
votes
1answer
176 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
5
votes
3answers
5k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
4
votes
2answers
825 views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
4
votes
4answers
1k views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
4
votes
2answers
87 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
4
votes
1answer
93 views

One time password question

Suppose F(X) = (5X) mod 9 is used to generate a one time password. I am supposed to generate the first 8 values using the above formula, starting with the seed value of F(5) Well I know that F(5) = ...
3
votes
4answers
143 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
3
votes
1answer
3k views

Please explain Time-step in Time-Based One-Time Password Algorithm

I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password) I have no issues with HOTP. But according ...
3
votes
3answers
2k views

Mobile OTP - Secure?

I came across Mobile-OTP, "a de facto standard for strong mobile authentication" (http://motp.sourceforge.net). The developers claim that it is very secure etc. Reading through the implementation, I ...
3
votes
2answers
884 views

Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?

In RFC 4226, the algorithm for HOTP is described as follow. HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
3
votes
1answer
562 views

HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been a ...
3
votes
4answers
275 views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
3
votes
1answer
129 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
3
votes
1answer
175 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
3
votes
1answer
239 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
3
votes
1answer
735 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
3
votes
0answers
118 views

Generate secure one-time codes containing information

I need to create a system that allows a user to enter codes to charge an allowance. Embedded in this code should be the amount to charge the allowance. The user would pay for a code which would then ...
2
votes
3answers
813 views

What are the main weaknesses of mobile software based OTP generators?

What are the main weaknesses of Software based OTP generators like Vasco's DigiPass for Mobile?
2
votes
3answers
273 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
2
votes
2answers
252 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
2
votes
1answer
745 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
2
votes
2answers
244 views

Where is the TOTP secret key stored on client applications?

I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
2
votes
1answer
169 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
2
votes
4answers
598 views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
2
votes
2answers
1k views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
2
votes
2answers
83 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
2
votes
1answer
551 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
2
votes
1answer
57 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
1answer
350 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
2
votes
2answers
852 views

Security evaluation of Vasco's Digipass Mobile SDK for OTP?

Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices? I am currently performing a full security evaluation of the solution ...
2
votes
0answers
69 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
1
vote
1answer
128 views

How to cryptoanalyze a one time pad that uses a plain text document as the pad?

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the ...
1
vote
2answers
422 views

Can I use hardware token OTP to stop piracy?

Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
1
vote
1answer
106 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
1
vote
1answer
37 views

Lamport OTP system

This might be a stupid question but forgive me. Is the Lamport OTP algorithm different from HOTP and TOTP? How similar or different are they? Thanks in advance
1
vote
1answer
113 views

Verification code generation and expiration

I am trying to implement an application that includes registration, In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
1
vote
1answer
301 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
1
vote
1answer
55 views

Implement GPG Verification (Bitcoin-OTC)

I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...