I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)

I have no issues with HOTP. But according to RFC6238 in section 4.2, TOTP is defined as
TOTP = HOTP(K, T) where T = (Current Unix time - T0) ÷ X.

I have studied the RFC. I am confused between timestamp and time-step. (timestamp is current unix time I guess) but what is time step?

How does resynchronization occur? It is said like this in the RFC:

... If the time step is 30 seconds as recommended, and the validator is set to only accept two time steps backward ...

What does it mean? Does TOTP have Throttling parameter and window size as in HOTP?


Overview. TOTP is pretty simple and is described pretty well in the RFC you linked to again. You might want to read through the RFC another time: it's all there. I'm going to summarize the RFC for you, but you could have gotten all of this yourself by reading the RFC.

Time steps. For example, you asked about what is a timestamp vs a time step. The first two paragraphs of Section 4.2 define these terms. As it says there, T is the number of time steps between the initial counter time T0 and the current Unix time. X is the size of the time step, e.g., 30 seconds. See the third paragraph of Section 4.2 of the RFC for an example.

Resynchronization. Section 6 describes how resynchronization works. Read that section for details.

For instance, suppose the client thinks that the current time is 10:01:20 (i.e., 1 minute and 20 seconds after 10 o'clock), and the server thinks that the current time is 10:02:07. In other words, the server's clock will be 47 seconds forward from the client's. Let's say for simplicity that the initial time is 10:00:00 (in practice it will be much farther back in the past, but I want to keep the numbers small here), and the time step is 30 seconds. The client will calculate T as the number of time steps from the starting point, i.e., T = floor(80/30) = 2. The client will generate a one-time password as HOTP(K, 2). However, the server's time is different, so the server will compute T' = floor(127/30) = 4, and the server will be expecting the one-time password HOTP(K, 4). The client's password will not match what the server is expecting.

If the client's one-time password does not match HOTP(K, T'), then the server also checks whether it matches HOTP(K, T'-1) and HOTP(K, T'-2). In our example above, the client's one-time password does match HOTP(K, T'-2), so the server allows the client to log in successfully. The server can also tell that the client's clock is about 2 time steps behind the server's, so the server can update its records for that client. When the client next tries to log in, the server will compute T' based upon an adjusted version of its own clock, adjusted for its estimate of the clock skew.

This is pretty straightforward and standard stuff, and is all explained in Section 6.

Discussion and caveats. What are you using one-time passwords for? Be warned that they have a number of drawbacks. Their most severe limitations is that they are not secure against man-in-the-middle attacks, they are not secure against client-side malware, and they are not secure against phishing attacks.

You might want to consider other means of user authentication, and re-consider whether one-time passwords are the best solution to your particular problem. The method that is best for you will depend upon your particular application.

  • 2
    @D.W. - What you describe also applies to normal passwords. Pretty much any authentication that does not require say a security cert ( i.e. a Smart Card, Biometrics, ect ) can be weak against phishing attacks, MiTM, and malware infections. Even those can be exploited in certain ways depending on the situation.
    – Ramhound
    Mar 19 '12 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.