I am new to Google Authenticator mechanism. I have gone through the basics of mechanism but I couldn't understood the logic behind it to make a connection to the Linux machine.

I have a Linux machine which has no Internet connectivity and its stored in an internal network where 'n' number of people will access the machine. Here how my mobile exactly identifies my Linux machine IpAddress to sync the seed and counter part to generate the exact secret key.

And one more question is if I have 10 Linux machines and I installed Google Authenticator then how the mobile will identify the exact Linux machine.

I have gone through net and found it's something like KeyURI Format.

KeyURI format: otpauth://TYPE/LABEL?PARAMETERS

Here I didn't find any connection to my server.

Can anyone please explain the process in nook and corner to deep.

1 Answer 1


Google Authenticator is a offline authenticator. It can both be time-based or event based. Time-based means it will use a Clock to detect the correct code to display.

To prevent desynchronization because the Clocks are imprecise, you simply have a correction factor, so you configure the server to accept a previous code, current code, or a later code. If a previous code is used, you store "-1" in database. If a later code is used, you store "+1" in a database. And then you decrease or increse the number according to syncronization. "-1" would then mean you accept the code corresponding to time -2, time -1 and time. "+2" would then mean you accept the code corresponding to time +1, time +2, and time +3

A important thing is to store the time of the last accepted code, so codes that are equal or previous to the used code cannot be reused.

Since the authenticator is completely time-based, it will mean the same key can be used for unlimited number of servers. Please note that if servers are offline or cannot talk with each other, then a spent code from a machine can be reused at Another machine, provided it hasnt expired in time.

You can also use a Event-based setting, with a counter that Counts up for each display of the code, and then you simply accept all codes that are up to lets say 50 events in future, and then store the Count of the last used code so codes cannot be reused, but then you need one unique key for each machine.

The KeyURI format is to initalize the Google Authenticator, normally you embed the KeyURI in a QR code displayed on screen on account setup, and then you scan it with Google Authenticator to add the seed to Google Authenticator. You simply type a friendly name as "label", for example: "Server at" And then when you look in Google authenticator, you might see:

542208 (pie of decreasing time)
Server at

389578 (pie of decreasing time)
Server at

and so on. Then you know which code you should type in.

  • From my understanding , then there is no connection between the mobile phone having google authenticator and linux machine having google authenticator ? Everything the key or seed is calculated based on the time available in the system and mobile.If both are sync in time, then the code will be accepted ? If not , the authentication will failure?
    – user45475
    Feb 19, 2015 at 18:12
  • Exactly. But as I pointed out, its possible to compensate for Clock drift on the server side, by having your system accept a code that is a Little bit out of sync (as long as the code is not behind a spent one). Thus if the Clock slowly drift out of sync, the server will compensate the authentication Clock to account for this. The seed is imported by either manually keying it into mobile, where its saved into local storage, or by scanning a QR code containing the seed, that is saved in local storage. Feb 19, 2015 at 21:53
  • In this case, if multiple server can be authenticated by a single key by enabling the sync across all machines. And another one more thing is that after installing the authenticator in 10 mobiles by keeping the time sync in all mobiles will it lead to compromise ?
    – user45475
    Feb 19, 2015 at 22:56
  • No you dont need sync across all Machines. Each machine will automatically pick upp any desync at next authenticate as long as it does not desync more than 1 period (30 or 60 sec). And no, you dont need to keep sync across all mobiles. Since all mobiles of a particular model will have the roughtly same "drift", you will still have sync even if you have authenticator across 10 of YOUR mobiles on the same account. However, if its multiple peoples, you set up a separate account for each one, with its own seed, "time of last used code" and sync value (eg, -5 or +2 or whatever the sync is). Feb 21, 2015 at 0:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .