We’re rewarding the question askers & reputations are being recalculated! Read more.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 83318

Time-based One-time Password Algorithm

4
votes
There is nice RFC describing the TOTP: RFC 6238, which mentions also usage of SHA-512. I did this in my implementation of OTP token in Javascript. But even the RFC has code examples in Java (same as … HOTP). HOTP later is basically HMAC with secret encoded in hexadecimal and with the counter (from above -- time for TOTP) padded to specific amount of digits. From the resulting hash, you take only …
answered Mar 17 '16 by Jakuje
1
vote
I do understand that the attacker can only access your account once because the TOTP token would expire after 30 seconds. This is case for TOTP. But there are a lot of HOTP based on counter … password). This is also the case of most of hardware tokens and SMS tokens. You send the current TOTP token that directly from your phone to the server of the site you were trying to log into from your …
answered Jul 29 '16 by Jakuje
1
vote
That is not a good idea for several reasons: OTP has to be second factor! It can not be the only factor in authentication 30 seconds for TOTP is secure because during that time attacker can not …
answered Mar 9 '17 by Jakuje
3
votes
Yes. Concept of two factors is to authenticate using any combination of the below methods Something you know (password) Something you have (OTP token with secret) Something you are - Fingerprint, re …
answered Jun 24 '16 by Jakuje
5
votes
Have a look how the HOTP (TOTP is just a special case based on a time for now) is calculated. It is using HMAC based on hash function either SHA1, SHA2 (or MD5 in worst security case) of secret seed … example 32 B hexadecimal string) and compare them with the intercepted data. This could work with the TOTP since you can know also the time when it was generated (30s time frames). But in the HOTP …
answered Jun 20 '17 by Jakuje