4

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable.

But suppose you have a server and client - the server always requires a password and has a pool of n possible username/password combinations.

In order to connect the client has to provide valid credentials.

You don't want to hardcode the password into the client software but instead implement an algorithm that will figure out the right password based on timestamp.

I am looking of a robust algorithm to achieve that, or suggestions for a better approach to the problem.

Improve this question
4
  • what type of client is it? something that's publicly available, or something for internal use?
    – Jay
    Oct 16, 2015 at 11:19
  • Should the password only be valid for a certain time or what do you mean by "based on timestamp"?
    – John
    Oct 16, 2015 at 11:19
  • If the intention is that only the client can log in, why not use public/private key authentication? Embedding an algorithm that constructs the password is the same as embedding the password directly. If someone can reverse engineer the code to find the password, they can reverse engineer it to find the algorithm.
    – Chris Murray
    Oct 16, 2015 at 11:21
  • 1
    To answer the question, time based one-time passwords are predictable and based on time. However, as Chris Murray says, it's essentially the same as hard coding the password once you know the algorithm en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
    – Jay
    Oct 16, 2015 at 11:28

1 Answer 1

Reset to default
1

You want to set up a security system where the password is derived, both client-side and server-side, from the current timestamp via a certain algorithm.

Either

  1. you keep the algorithm secret (security by obscurity) which is a terrible choice, as once the algorithm is discovered your whole system falls apart, or

  2. you introduce a shared secret, which must be shared between client and server, in the computation of the password; in this case you might as well use the shared secret as password, without need for the algorithm. (This is what is done e.g. in RSA Tokens, where the shared secret is embedded in the hardware.)

In both cases, you need strict time synchronization between client and server to be sure that the algorithm outputs the correct result.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.