0

Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call.

Among these options, there are some mobile apps that can generate the OTP offline without internet connection (so-called Authenticator apps).

These apps often get some basic information like some passwords and then they create an OTP for 1 minute or at least seconds before the end of the minute. What is the most common algorithm and what is the best one?

1
  • The "best" one for what?
    – schroeder
    Aug 27 at 21:09

1 Answer 1

4

There are two common algorithms used for this: HOTP (HMAC-based OTP) and its variant TOTP (time-based OTP). Both algorithms use HMAC with a secret and some sort of counter to generate a one-time password.

HOTP keeps a common state for the counter, and TOTP uses a count of (usually) 30-second intervals to do this. For TOTP, since usually a site will accept three codes (the current, the previous, and the following) at any given time, it's important that the device be kept in sync within about 30 seconds, but this is usually not a problem if the user is using a smartphone, even if they happen to be offline (say, because they're on an airplane and only their laptop is on wi-fi).

If you're unsure, TOTP is the best choice here and most common, and it's supported by the most common smartphone apps (Google Authenticator and Authy, among them), it's easy to use for most people. If you're using a physical device which doesn't frequently receive time updates, HOTP may be more desirable, but the use of TOTP on a smartphone is typically easier to use. Both use cryptographically secure generation algorithms, although TOTP is better supported in client apps and doesn't require keeping a counter state, and typically HOTP requires accepting more codes to deal with counter skips, which reduces the security somewhat.

I strongly recommend not using a proprietary company's software and app to do this for you because this means that users have to have lots of random, one-off apps that are hard to manage and hard to switch between devices when they get a new phone. TOTP is easy to handle from a library in your preferred language and the QR code handling is not hard, either.

3
  • Thanks. I saw this Github repo: github.com/kspearrin/Otp.NET#base32-encoding. But I don't understand these lines: hmacComputedHash[offset] & 0x7f) << 24 , (hmacComputedHash[offset + 1] & 0xff) << 16 , ...
    – Arian
    Aug 28 at 8:22
  • If you're asking about code, please open a new question on Stack Overflow. The comments are not a great place for asking additional questions.
    – bk2204
    Aug 28 at 9:48
  • I wrote my question in this topic: stackoverflow.com/questions/73517160/…
    – Arian
    Aug 28 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.