All about Time-Based One-Time Passwords (TOTP)
It's possible that you've become familiar with the term "time-based one-time passwords" (TOTP) in relation to "two-factor authentication" (FA) or "multi-factor authentication" (MFA).
However, do you really understand TOTP and how they work?
The Meaning of TOTP
"Time-Based One-Time Passwords” refer to passwords that are only valid for 30-90 seconds after they have been formed with a shared secret value and the current time on the system.
Passwords are almost always composed of six-digit sequences that are changed every thirty seconds. On the other hand, some implementations of TOTP make use of four-digit codes that become invalid after a period of 90 seconds.
An open standard is used in the TOTP algorithm, and this standard is detailed in RFC 6238.
What is a shared secret?
TOTP authentication uses a shared secret in the form of a secret key that is shared between the client and the server.
To the naked eye, the Shared Secret seems to be a string with a representation in Base32 that is similar to the following:
KRUGS4ZANFZSAYJAONUGC4TFMQQHGZLDOJSXIIDFPBQW24DMMU======
Computers are able to comprehend and make sense of information even if it is not legible by humans in the manner in which it is presented.
The client and the server both have a copy of the shared secret safely stored on their respective systems after a single transmission of the secret.
If an adversary is able to discover the value of the shared secret, then they will be able to construct their own unique one-time passcodes that are legitimate. Because of this, every implementation of TOTP needs to pay particular attention to securely storing the shared secret in a safe manner.
What is system time?
There is a clock that is integrated into every computer and mobile phone that measures what is referred to as Unix time.
Unix time is measured in terms of the number of seconds that have passed since January 1, 1970, at 00:00:00 UTC.
Unix time appears to be nothing more than a string of numbers:
1643788666
This small number, however, is excellent for the generation of an OTP since the majority of electrical devices using Unix time clocks are sufficiently synced with one another.
Implementations of the TOTP Authentication Protocol
The use of passwords is not recommended. However, you may increase security by combining a traditional password with a time-sensitive one-time password (TOTP). This combination is known as two-factor authentication or 2FA, and it may be used to authenticate your accounts, virtual private networks (VPNs), and apps securely.
TOTP can be implemented in hardware and software tokens:
• The TOTP hardware token is a physical keychain that displays the current code on a small screen
• The TOTP soft token is a mobile application that displays a code on a phone’s screen
It makes no difference whether you use software tokens or hardware tokens. The purpose of using two different forms of authentication is to increase the level of protection afforded to your online accounts. You have access to a one-time password generator that you may use during two-factor authentication to obtain access to your account. This generator is available to you regardless of whether you have a key fob or a smartphone with an authentication app.
How does a time-based one-time password work?
The value of the shared secret is included in the generation of each time-based one-time password (TOTP), which is dependent on the current time.
To produce a one-time password, the TOTP method takes into account both the current Unix time and the shared secret value.
The counter in the HMAC-based one-time password (HOTP) method is swapped out for the value of the current time in the time-based one-time password algorithm, which is a version of the HOTP algorithm.
The one-time password (TOTP) technique is based on a hash function that, given an input of indeterminate length, generates a short character string of fixed length. This explanation avoids getting too bogged down in technical language. If you simply have the result of a hash function, you will not be able to recreate the original parameters that were used to generate it. This is one of the hash function's strengths.
It is essential to keep in mind that TOTP offers a higher level of security than HOTP. Every 30 seconds, a brand new password is produced while using TOTP. When using HOTP, a new password is not created until after the previous one has been entered and used. The fact that the one-time password for HOTP continues to work even after it has been used for authentication leaves hackers with a significant window of opportunity to mount a successful assault.
Authentication using Multiple Factors (MFA)
A user must first register their TOTP token in any multi-factor authentication (MFA) system that supports a time-based one-time password before they can use the device to connect to their account.
Some TOTP soft tokens need the registration of a different OTP generator for each account. This effectively implies that if you add two accounts to your authenticator app, the program will produce two temporary passwords, one for each account, every 30 seconds. A single TOTP soft token (authenticator program) may support an infinite number of one-time password generators. Individual one-time password generators safeguard the security of all other accounts in the case where the security of an account is compromised.
To use 2FA, a secret must be created and shared between the TOTP token and the security system. The security system's secret must then be passed to the token.
How is the shared secret sent to the token?
Typically, the security system creates a QR code and requests that the user scan it using an authenticator app.
A QR code of this type is a visual depiction of a lengthy string of letters. The shared secret is, roughly speaking, part of this lengthy sequence.
The software will string the image and extract the secret when the user scans the QR code using the authenticator app. The authenticator program may now utilize the shared secret to generate one-time passwords.
When registering a TOTP token, the secret is only sent once. Many of the concerns about stealing the private key are alleviated. An adversary can still steal the secret, but they must first physically steal the token.
It works even when you're not connected to the internet!
To use the TOTP technique, you do not need an active internet connection on your smartphone or a physical key.
The TOTP token only needs to obtain the shared secret value once. The security system and the OTP generator may thus produce successive password values without needing to communicate. As a consequence, time-based one-time passwords (TOTP) operate even when the computer is turned off.
