How many known time/result combinations does it take to guess a HOTP/TOTP secret? - Information Security Stack Exchange most recent 30 from security.stackexchange.com 2019-11-23T01:35:01Z https://security.stackexchange.com/feeds/question/162348 https://creativecommons.org/licenses/by-sa/4.0/rdf https://security.stackexchange.com/q/162348 5 How many known time/result combinations does it take to guess a HOTP/TOTP secret? Bob Ortiz https://security.stackexchange.com/users/72031 2017-06-20T09:00:02Z 2017-06-20T12:20:08Z <p>I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known.</p> <p>In case we can view the live creation of HOTP/TOTP codes without knowing the actual secret. </p> <ol> <li>How many known results (combination of time and the 6-digit code) does it take in order to "guess" the secret key? </li> <li>And so, how likely is it that we can successfully recover the secret key in order to reuse it and validate the produced output?</li> <li>Are there (code) examples of how this could be achieved? </li> </ol> https://security.stackexchange.com/questions/162348/-/162367#162367 5 Answer by Jakuje for How many known time/result combinations does it take to guess a HOTP/TOTP secret? Jakuje https://security.stackexchange.com/users/83318 2017-06-20T12:20:08Z 2017-06-20T12:20:08Z <p>Have a look how the HOTP (TOTP is just a special case based on a time for now) is calculated. It is using HMAC based on hash function either SHA1, SHA2 (or MD5 in worst security case) of secret seed and some counter. It is returning some part of the result as a PIN.</p> <p>As an attacked intercepting the PINs, you are trying to find out a secret seed of unknown length.</p> <p>Based on the definition of hash function, it not reversible (unless it is broken). You can not simply reverse the operation even if you would have the whole hash. But you have 6 to 8 decimal numbers. You also do not know where they fit into longer decimal string -- this is also changing based on last byte). </p> <p>So what are the options you have? The easiest way would probably be to brute-force all the possible values for seed (for example 32 B hexadecimal string) and compare them with the intercepted data. This could work with the TOTP since you can know also the time when it was generated (30s time frames). But in the HOTP, you have no idea what the counter is (unless you would manage to intercept <strong>all</strong> the PINs.</p> <p>I would say, the strength of the OTP is its complexity of the algorithm and simplicity of use. I am not giving a proof why it is hard, but I hope the answer summed your question and answers why you can not simply do that.</p>