6

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?

So, these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

3
  • 5
    Time-based password algorithm is indeed a standard: tools.ietf.org/html/rfc6238
    – George Y.
    Sep 22 '18 at 7:14
  • Thank you. I thought that each application use their own algorithm. Sep 22 '18 at 7:45
  • 1
    That would destroy usability. Making it easy to use is a major factor in increasing 2FA use.
    – vidarlo
    Sep 22 '18 at 8:51
12

these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

Yes.

There are two commonly used protocol for authenticator apps:

  • HOTP (HMAC-based one time password), which is specified in RFC 4226
  • TOTP (Time-based one time password), which is specified in RFC 6238

The algorithms for the two protocols are specified in open standards, so yes, all implementations of it are inter compatible.

3

All of the apps you listed share an algorithm. This allows them to be compatible and largely interchangeable.

However, there are other schemes that appear nearly identical from a user standpoint but do not use the same algorithm. For example RSA Authenticate uses a proprietary algorithm which is a type of TOTP, but is not compatible with RFC 6238.

0

If each app used its own algorithm, then each site would need to use a particular authenticator app since each site would need to use that algorithm.

In some cases, this does happen. Some sites and services use their own authentication app and base it on the common standards, but you can't always use another app. Steam is an example of this situation, but this is not the common or usual case.

-3

They all use the HOTP algorithm. Before, various proprietary alogrithms were used. They seemed to be easy to exploit, so we migrated to open standards.

1
  • 2
    It is not all HOTP. And what do you mean by "various proprietary alogrithms were used. They seemed to be easy to exploit" what algorithms do you mean? What exploits?
    – schroeder
    Aug 9 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.