All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours.

I am wondering what would be the drawback if I send the same OTP for every user request in the said X hours?

So let us say X = 2, then once an OTP is sent, all further requests for OTP in the next 2 hours would send the same OTP. Any requests after the 2 hours will generate a new OTP.

I have an application where we use OTP. The reason I ask is that sometimes the OTP SMS is delayed, and so user requests for another OTP. Finally when the SMSs do arrive the user is unsure which OTP to use.

  • 'Per user' I assume? Your post does not say so explicitly. – user13695 Aug 11 '14 at 10:20
  • yes 'per user'. 2 OTP requests for 2 different users at the same time, will produce different OTPs – arahant Aug 11 '14 at 10:33

The idea behind an OTP is that it can only ever be used once, hence "One Time Pin". If you reuse the same OTP for a certain time period you are not using it only once. The single use is to ensure that a lost of compromised OTP becomes ineffective as soon as a new one is requested.

If your "OTP" that is valid for a certain time period (2 hours in your example) is compromised, the malicious user can use that for that same time period.

Imagine for a moment Alice wants to perform some action on your application that that requires her to enter an OTP - at the time she is working from a coffee shop over Malory's Rouge Access Point. As Alice receives her OTP and enters it, Malory intercepts it and figures out what she can do with it.

Now Malory has 2 hours of freedom to perform any function as Alice (assuming she has the necessary other information to impersonate Alice) using the OTP that is still valid AND even if Alice requests a new OTP, that same compromised OTP will be sent to her, persisting Malory's ability to impersonate Alice.

if it were a single use OTP, Malory would have no use for it from that point onward.

|improve this answer|||||
  • 1
    I think what he meant was not using the same OTP more than once - what as you mentioned beats the basic principal of OTP, but rather re-send it if the user asks for a new one before having used the old one. – aviv Aug 11 '14 at 10:39
  • Ah, I see. If the use of an OTP in that system does indeed result in the OTP becoming ineffective, then I agree with your observation that it would not significantly reduce the security of the system. – ilikebeets Aug 11 '14 at 10:46
  • 1
    never the less its a good example of what could go wrong - depending on the way the system is meant to work. This is a good example of how this complication might end up being a vulnerability – aviv Aug 11 '14 at 10:56

The only drawback I can think of - which is a serious drawback to take into account) is that you are introducing new logic into the process which will complicate your implementation and eventually might introduce bugs which will degrade your security.

By the way - if you want to try and solve the user experience you might just add a comment on your UI that the OTP might take X minutes to arrive...

|improve this answer|||||

If you're thinking of doing all the work to send the same P for a given user within an X hour window, why not do the same amount of work to permit your authentication backend to accept any of the N P's you've sent over the last X hours? That neatly resolves your issue with impatient users without compromising the OT in OTP. (Needless to say, all P should be invalidated as soon as one is successfully used.)

Using the same P will look less secure - to your users, and (if you have any) to your auditors. An OTP without OT isn't advisable, as much for appearances as for true security

|improve this answer|||||
  • that sounds like a good idea – arahant Aug 11 '14 at 14:09

I think all the answers pointed out, that you will weaken your security. Since you either make a password reusable (if you allow the same one time password to be used for a time period again) or you weaken security by allowing several OTPs to be valid at once.

Well, I saw many of those requests during my time implementing an OTP solution and I can understand them. We even had the request to have a "day password", a password that is valid for one day for as many logins as you like and changes the next day automatically. This is no one time password anymore but in certain scenarios a legit requirement.

The solution I am talking about is privacyIDEA. It can send SMS and will also invalidate the previous OTP value if it sends a new one. But this behaviour can be easily enhanced with about 3 lines of code in the SMS module.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.