16

I'd like to implement multi factor authentication on a few projects.

Now the first factor would be username and password, for the second factor I would like to use a token generator.

These tokens would be 6 characters long and generated by a device that the user carries (like a phone or special device)

But... I have no idea how a token generator works and how to implement it. (so I'm here to learn)

I would eventually like to build a phone app to do the token generation and a website (php) where the use would login.

Can anyone please give me some pointers in the right direction on how these algorithms work?

| improve this question | |
  • Look at existing implementation of OTP available instead of rolling own your own implementation. A list is available at en.wikipedia.org/wiki/One-time_password. I would suggest Google authenticator which has multiple client and server side implementations for various use-cases. – jhash Mar 8 '17 at 22:26
7

There are a lot of existing ones, and they come with their own APIs. You can implement any algorithm you wish. See this site.

Drawing it up from scratch, for disconnected tokens you have a few options. They can be:

  • counter-based -- a new password with every press and the authenticating system doesn't allow anything at least as old as the last used password
  • time-based -- the algorithm factors in the current time and the server doesn't allow anything other than present, the minute before, and the next minute (or possibly a slightly wider window); requires good time sync

You need to seed an unpredictable sequence based algorithm with a secret shared value and either the time or your counter. hash(time . secret) or such. Using SHA-256 and chopping off some bits would be effective.

Strength comparisons:

  • RSA token -- 8 numeric digits, 108 (one in a hundred million)
  • six numeric digits, 106 (one in a million)
  • six alpha-numeric, 2.1x109 (one in 2 billion)
  • six alpha-numeric, with caps: 5.6x1010 (one in 56 billion)

See also:

| improve this answer | |
6

Some important ancilary design considerations.

Single user or multi-user?

If this is a pet project just for you then a lot of support tasks are easy. However, if this is a multiuser system, then you need to consider more factors.

Unified token or per-person token?

A unified token is a token that provides equivelent authentication for all users. That is even if there are multiple physical devices, any user may use any physical device for authentication. This is convenient for support, but weak for authentication. On the other hand a per-user token may only be used by a specified user. Each user must be uniquely assigned to a different physical token device. If the user looses or damages the device the user must be assigned to a new physical device. Per-user provides stronger authentication, but operational support is more expensive.

Authentication system parameters.

There are some critical parameters such as delay between failed authentication and next authentication prompt. This fail delay helps protect against online attacks where the attacker has obtained the username and password, but does not have a valid token device. Another parameter is the number of failed attempts until the account is temporarily disabled. Adding the the previous setting is the temporary disabled time. That is how long after n failed attempts should the account be temporarily disabled.

Token device protection

Since the token device is an authentication component, the token device will be a tempting target for attackers. If you are thinking of using a mobile phone or smart phone, you need to think about how you will protect the token generating software from attempts to monitor or disrupt it. If your device is a custom device, what communication channels will it have (USB, Ethernet, RS-232) and how will those enable an attacker to analyze or modify the device?

| improve this answer | |
  • wow these are some great points! I've been working on a few tests, this whole project is to build a maximum security login system for future projects. – HTDutchy Oct 11 '11 at 8:41
  • 1
    Maximum security is extremely expensive in terms of dollars and in terms of resources. Strong integrity and confidentiality typically reduce an assets availability. I suggest you design the security proportional to the value of the assets you intend to protect. – this.josh Oct 11 '11 at 15:09
  • lets just say the best I can? – HTDutchy Oct 11 '11 at 16:23
  • It's not the best you can; it's the most your users are willing to tolerate before circumventing or abandoning your system. Requiring physical presence (no-network) provides great mitigation of exposure, but most users demand the ability to access your system remotely. – this.josh Oct 11 '11 at 20:53
6

I'm currently using the Google Authenticator as my OTP token of choice.

If you are new to this, I recommend reading up on the OATH Initiative. This ground has been well paved, good luck!

| improve this answer | |
5

You want to create a one-time password by hashing a key and counter (or timestamp). The token generator hashes the key and counter, truncates the result into 6 characters, and increments the counter. The server does the same to compare.

HOTP is a common algorithm with a counter, TOTP is one that uses a timestamp. One advantage of these is that hardware and software token generators are available for them.

Generating the token is the easy part; authenticating securely and reliably with that token is trickier. Duo Security has open source clients for use with our two-factor service, and they might be useful for reference. Disclaimer, I am a Duo employee.

| improve this answer | |
1

I'm currently using a solution from Billion for two-factor authentication. But at least in our setup it requires Windows computers. So I'm a bit curious on the YubiKey. Here are some more info.

https://www.grennan.com/?p=170

https://code.google.com/p/yubico-pam/wiki/ReadMe

| improve this answer | |
0

I would second looking into OATH, Google Authenticator uses it, as well as YubiKey. Actually, YubiKeys can be programmed to do a few different algorithms, as well as TOTP with a helper Windows application.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.