0

The commonly used Time based One Time Password (TOTP) system requires the initial sharing of a key. This presents a security risk, as acknowledged by Wikipedia referencing the RSA compromise:

An attacker with access to this shared secret could generate new, valid TOTP codes at will. This can be a particular problem if the attacker breaches a large authentication database.

Nearly three months after RSA Security was breached by hackers, the company has announced it will replace the security tokens for nearly all of its SecurID customers.

Knowing only a tiny bit about the mathematics behind these tools, there seems no obvious reason why such a one time password could not be generated with some asymmetric cryptography such that the validating party is not able to generate codes, just validate them.

Do such algorithms exist? Is they do, why are they not used? If they do not, why not?

Improve this question
11
  • 2
    It's not shared over a public channel, but a private channel. TLS ensures this. The RSA compromise was possible because a third party (RSA) held a huge number of secrets used in hardware tokens for it's customers. That kind of compromise is avoided by distributing secrets only shared by the two parties to the authentication.
    – vidarlo
    Commented Sep 5 at 14:06
  • TLS is not under the control for the authentication mechanism. I have worked at places where TLS was not guaranteed to be private.
    – User65535
    Commented Sep 5 at 15:48
  • 1
    Then fix that problem. If you have an attacker that can access things inside the TLS session 2FA is the least of your worries; the attacker can at will act with the same privileges as the user.
    – vidarlo
    Commented Sep 5 at 15:49
  • @vidario That still does not answer the question, what if the certificate authority gets hacked?. If you could change the maths involved in the protocol and NOT have to transfer a secret then would not that system be inherently better? Why implement an inferior system when a better one is available? "We" are rolling 2FA out now, why not use the best system available?
    – User65535
    Commented Sep 5 at 15:56
  • 1
    @User65535: So you don’t want TOTP, you don’t want WebAuthn, you don’t want specialized hardware, but a software solution isn’t possible either due to lack of support in Linux. You want a widely supported option, but none of the options which are actually widely supported. Maybe you’ll just have to wait until web applications support authentication via magic pixie dust.
    – Ja1024
    Commented Sep 5 at 17:54

2 Answers 2

Reset to default
5

There are certainly public-key protocols for multi-factor authentication, but they aren't TOTP-based – and there isn't really any good reason why they should be. TOTP is just a crutch to make password-based authentication slightly more secure. It was never meant to be particularly secure by itself.

If you use public-key authentication, then you can ditch both passwords and TOTP altogether. Two common public-key solutions are TLS client certificate authentication (aka mTLS, mutual TLS) and Web Authentication (aka WebAuthn). For two-factor authentication, you can use a PIN-protected smartcard or USB token.

Improve this answer
9
  • "there isn't really any good reason why they should be" protecting against the server getting compromised seems a pretty good reason. I was expecting an answer like "they generated passwords would have to be too long" or something. The obvious disadvantage the linked solutions have is the key is hard to transfer between devices manually, which is usually a feature of the TOTP implementations.
    – User65535
    Commented Sep 5 at 14:21
  • 2
    @User65535: As I've already explained, once you switch to public-key cryptography, TOTP becomes entirely useless. There are far better authentication schemes like the ones I've described. TOTP is neither the only nor a particularly good scheme, so I don't know why you think public-key authentication protocols should be based on TOTP. Can it technically be done? Sure, just google for it, and you'll find several hobby projects on GitHub which implement this. But if you're asking for a properly designed, standardized public-key variant of TOTP -- there's no such thing.
    – Ja1024
    Commented Sep 5 at 14:29
  • I really do not understand why I should care about the sort of maths, but I think that is another question.
    – User65535
    Commented Sep 5 at 14:39
  • 1
    @User65535: I have no idea what you're trying to say. You've asked if public-key variants of TOTP exist: Yes, as hobby projects on GitHub. Then you've asked if they're used (no) and if not, why that's the case: Because there's nothing about TOTP that would make it a good fit for public-key authentication -- or any secure authentication. Just because TOTP is somehow special for you doesn't mean everybody is keen on implementing TOTP-based protocols.
    – Ja1024
    Commented Sep 5 at 14:48
  • 1
    Passkeys are WebAuthn credentials.
    – Ja1024
    Commented Sep 5 at 15:54
1

No there aren't, and I think the reason lies in the origins of TOTP.

TOTP builds on HOTP, which was used in hardware tokens to provide a second factor for authentication. I used to have one for my bank, VPN login etc. Obviously these hardware tokens were cheap, low power devices; devices capable of public-key cryptography would have been more expensive to produce so a symmetric key algorithm was used.

Software implementations then became more widespread and increased the adoption of TOTP for MFA. But while they do add security to password based authentication, they still have issues beyond the use of a shared secret.

So rather than trying to "put lipstick on a pig", web authentication standards like U2F, FIDO and WebAuthn have moved on to use public-key cryptography, not only to remove the need for the shared secret but also to remove phishing threats while improving usability.

Improve this answer
1
  • 1
    it's also worth noting that those hardware tokens were physically handed out, instead of providing the seed to the user for loading into an app, so the private key was not shared (only a device with an internal knowledge of that) and certainly not over public channels.
    – Ángel
    Commented Sep 5 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .