3

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?

So, these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

  • 4
    Time-based password algorithm is indeed a standard: tools.ietf.org/html/rfc6238 – George Y. Sep 22 '18 at 7:14
  • Thank you. I thought that each application use their own algorithm. – mongkonsrisin Sep 22 '18 at 7:45
  • 1
    That would destroy usability. Making it easy to use is a major factor in increasing 2FA use. – vidarlo Sep 22 '18 at 8:51
7

these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

Yes.

There are two commonly used protocol for authenticator apps:

  • HOTP (HMAC-based one time password), which is specified in RFC 4226
  • TOTP (Time-based one time password), which is specified in RFC 6238

The algorithms for the two protocols are specified in open standards, so yes, all implementations of it are inter compatible.

0

All of the apps you listed share an algorithm. This allows them to be compatible and largely interchangeable.

However, there are other schemes that appear nearly identical from a user standpoint but do not use the same algorithm. For example RSA Authenticate uses a proprietary algorithm which is a type of TOTP, but is not compatible with RFC 6238.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.