1

The library I am using (ASP.NET Identity) to generate multi-factor authentication (MFA) codes will produce the same code for a given user within a certain period of time. Therefore if the user requests multiple codes in quick succession they will receive the same code multiple times.

From a security perspective, is this a problem?

It seems to be deliberate in the way the library has been designed. Am I missing some common method by which code repetition is avoided?

2

This is an intended functionality. There is no point in sending separate 2FA code every time within, for example, 5 minutes if it hasn't been used.

From a security perspective this isn't a problem, for if your 2FA method is compromised it won't matter if you send different or the same code. The main thing is for the pin code to not be easily guessable within the time frame it is repeated.

  • It's unclear if you're talking about using the same code multiple times, or just generating multiple times, because there's a big difference. If a TOTP verifier for example accepts the same code in the same window after it's already been used, it's not RFC compliant. – AndrolGenhald Sep 3 at 17:37
  • @AndrolGenhald Your right. I removed that part. – Raimonds Liepiņš Sep 4 at 7:22
1

Section 5.2 of RFC 6238 says that the code should not be used multiple times:

Note that a prover may send the same OTP inside a given time-step
window multiple times to a verifier. The verifier MUST NOT accept
the second attempt of the OTP after the successful validation has
been issued for the first OTP, which ensures one-time only use of an
OTP.

So even though the same code is produced at a certain time, it's not an issue if the user has logged in using it. The time window a code can last for can vary, but it has to be finite as it takes some time for the user to enter a code, submit it, and for it to be verified. The length of the code also impacts how often it will be repeated - a 6 digit code being generated every 10 seconds will by necessity repeat three times a year.

Time-based isn't the only way, you could use a counter, but that comes with its own set of problems - the code does not continually update for one.

0

The main question is if the MFA code is predictable enough or not.

Just because "the same code" (so likely not a specific code known to the attacker) will repeat within a "certain time" (no idea how long this is and if it is a fixed time) does not mean it is predictable. And absence of these does not mean it is not predictable. In fact, if you have a limited range of output values (like 4 digit PIN) it is impossible that one of these will not be output again after some time.

In other words: based on the information you've provided it is impossible to say if this is a problem or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.