One-time password (OTP) protocols and implementations (software and hardware)
1
vote
0answers
49 views
Store 2-legged one-time password's key securely
I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
1answer
30 views
Implement GPG Verification (Bitcoin-OTC)
I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...
1
vote
1answer
65 views
Secure copy-paste from phone to computer
Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
1
vote
0answers
61 views
How secure is a password app that stores both the password and two factor secret in one place?
Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault).
I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
1answer
20 views
When, during authentication, should I ask for an OTP token?
I was working on implementing an OTP strategy in our login process of a web application when I was asking myself: Should I ask for the OTP token before or after asking for the username/password?
What ...
0
votes
2answers
34 views
Usability of a found OTP Token for my own system [closed]
I found a one-time-password token and am unable to find out who it belongs to or where it has been used.
It seems to be manufactured by a company called "ActivIdentity" (now "HID") and called the ...
0
votes
3answers
49 views
How to integrate AAA and otp
We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
-1
votes
1answer
24 views
Double step verification system for homepage
I want to share some of my work with some double step verification system.
PGP is not enough, since some of my clients cannot use it.
First, you need a password to login but you also need the code ...
2
votes
1answer
87 views
Should LastPass use the YubiKey public identifier as a secret key?
I've just picked up a YubiKey.
However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
0
votes
0answers
22 views
Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)
I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to ...
1
vote
1answer
60 views
Best practices for usefully storing two factor authentication backup codes?
For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
0
votes
1answer
38 views
Algorithms for transaction authentication
It's unclear to me how transaction signing and transaction authentication work.
Industrial solutions use both symmetric and asymmetric algorithms to compute the signature.
What does RSA add the ...
2
votes
0answers
42 views
HMAC-SHA256 Transaction signing [closed]
Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
0
votes
1answer
85 views
find out the algorithm based on some examples?
I have an OTP generator that receive two numbers less than 99 as input and return an 8 digit number as its output. I know it has a simple algorithm. because its processor is just an ATMEGA8 micro ...
1
vote
1answer
106 views
How to cryptoanalyze a one time pad that uses a plain text document as the pad?
I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the ...
4
votes
1answer
621 views
What are the differences between the U2F and UAF FIDO authentication standards?
Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
32
votes
4answers
7k views
How secure are the FIDO U2F tokens
Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
-1
votes
1answer
36 views
Can OTP 2FA be reversibly determined?
Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...
2
votes
4answers
257 views
One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power?
If not, what algorithems are immune to bruteforce attacks against ...
1
vote
1answer
53 views
Verification code generation and expiration
I am trying to implement an application that includes registration,
In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
0
votes
1answer
143 views
Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]
I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it.
This would work as an (almost)zero knowledge proof for sending passwords that can ...
2
votes
1answer
213 views
What are the typical ways to generate a One Time Password?
I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
0
votes
3answers
299 views
Is it possible to use OTPs for WI-FI?
Is it possible to configure an access point to use OTPs for authentication and encryption ?
1
vote
1answer
81 views
OTP for syncing mobile device
Scenario: a web app with two-factor authentication using username/password and hardware OTP.
Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
0
votes
4answers
160 views
Why must every OTP be unique
All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp)
Only the latest OTP is valid and an OTP can only be used for X hours.
I am wondering ...
0
votes
2answers
92 views
Are there any flaws in my design for a paper-based OTP grid?
I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application:
Cards are ...
0
votes
2answers
169 views
Where is the TOTP secret key stored on client applications?
I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
6
votes
1answer
149 views
Google Authenticator Error on Reboot
I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
1
vote
1answer
114 views
Algorithm to Transaction Data Signing
Transaction Data Signing
I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device.
What is the idea?
The ...
0
votes
1answer
73 views
“Reverse” approach to one-time key generation
Suppose we have a master key, and we want to encrypt some file(s). We then generate one-time key for that file, use it to encrypt file contents, and finally encrypt one-time key using master key (with ...
3
votes
1answer
396 views
How do OTP USB sticks work?
I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
1answer
231 views
KeePass OTP plugin circumvents inbuilt protections?
I have read the question on HOTP implementation in KeePass HERE. This question is however on the other newer plugin KeeChallenge.
According to the documentation, the a secret is encrypted and can ...
0
votes
1answer
142 views
Storage of the One Time Password Seed
I'm a student and I'm working on an OTP authentication systeme based on
OATH using smart phones as tokens for the clients.
My problem is the protection the OTP seed at both client and
validation ...
10
votes
2answers
1k views
LastPass Grid Authentication vs Google Authenticator which one is more secure?
[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
1
vote
1answer
50 views
Issues of using HOTP w/ iteration window
I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
0answers
41 views
Is there a TOTP variant that does not require the user to type in a code? [closed]
We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
4
votes
0answers
768 views
FIDO, U2F Compatibility
I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
6
votes
1answer
228 views
Why does my bank bother asking basic personal questions to log in to online banking?
To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
-3
votes
1answer
288 views
Why don't we do dual password instead of forgot password?
You can see a link Forgot Password? nearby almost all login form.
As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
199 views
Are there any secure ways to store the secret key used in a TOTP scheme?
I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
2
votes
2answers
868 views
How to write a rock solid TOTP implementation?
I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered?
After reading the ...
2
votes
2answers
70 views
HOTP/similar - how about standard backups of mobile devices?
I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has:
Things such ...
3
votes
1answer
121 views
Should an administrator be able to turn off TFA for a user
We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?
Google Auth uses SMS as backup option but SMS does not ...
2
votes
2answers
647 views
Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
In RFC 4226, the algorithm for HOTP is described as follow.
HOTP(K,C) = Truncate(HMAC-SHA-1(K,C))
TOTP is essentially the same algorithm as HOTP except for the fact that the counter C is ...
3
votes
1answer
156 views
S/Key as an alternative to UNIX passwords
There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
0
votes
2answers
1k views
Google Authenticator - Counter Based [duplicate]
I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
1
vote
1answer
216 views
Storing Seed for TOTP
We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
4
votes
2answers
643 views
Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?
I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more.
Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
5
votes
3answers
4k views
Does adding two-factor authentication by OTP really make KeePass more secure
KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
2answers
206 views
Using authentication only one time passwords [duplicate]
I would be interested in advice.
Imagine a authentication mechanism where users are authenticated ONLY using
some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?
...
