Two-Factor Authentication 2FA: An Overview of HOTP and TOTP

Muhammad Ali, Peshawa

doi:10.13140/RG.2.2.35704.42245

Two-Factor Authentication 2FA: An Overview of HOTP and TOTP

Muhammad Ali, Peshawa

Publisher: Zenodo
DOI: 10.13140/RG.2.2.35704.42245
Repository: zenodo.org
Language: en

Abstract

Two-factor authentication (2FA) is a security process that users must provide two distinct authentication factors to confirm their identity. Usually, the first factor is the traditional password, while the second factor may be unique physical device tokens the user has, such as a mobile app, smart card, or a security token, or it may be biometric data like eye retina, fingerprint data, or a face biometric. 2AF is a member of a bigger family called Multi-Factor Authentication (MFA), which a group of techniques requires the end user to provide more than one credential before gaining access to the applications. The main goal of using 2FA is to provide an extra security shield to protect users’ data and assets. Passwords alone are vulnerable to various attacks, such as brute force, phishing, or password guessing. Even if a password is compromised, an additional factor is required for access, making it more challenging for unauthorized users to gain access to an account or system. The key reasons for using 2FA can be summarized in some points: to enhance the security level of the users’ data, and accounts, the attackers will not be able to log into the account even if they got the password. Users may choose weak passwords, reuse them across multiple sites, or fall victim to phishing attacks. 2FA helps mitigate these risks by requiring a second form of authentication. Some specific applications, like bank transfers, obligatory apply 2AF to protect the customers. Furthermore, 2FA helps prevent unauthorized access to remote access networks, this will strength the security of some sensitive applications, like experiments belongs to the scientific institutions, and remote medical interventions. One of the ways to provide the 2FA is one-time password (OTP), which is a form of multifactor authentication (MFA) and an extra layer of protection. For example, while using a credit card, and making money transaction to another account, the bank sends the customer an OTP code (a number, or a text) through mobile SMS message, and requires the customer to enter it. In this way the bank will make sure that the person using the card is the customer himself not another person. The important thing here is that this code can be used for only one transaction, the same thing will be repeated for all the future transactions. Other ways of MFA may include, answering personal security questions, USB devices, using biometrics, or using OTPs generated by smartphone applications. While talking about the OTPs we must mention hash codes. Because hash code is the technique used to generate the codes of OTP. A hash code is a value generated from a string of text. It is a fixed-size numerical or alphanumeric representation of data that is typically generated by a hash function. Hash functions are algorithms that take input (or 'message') and produce a fixed-size string of characters called a hash code. Famous hash code algorithms are MD5, SHA-1, SHA-2, SHA-3, SHA-256, SHA-512, CRC32…. etc. The common among these algorithms are: they must be deterministic, i.e., produce same output for the same input, irreversible, a small change in the input must produce a big change in the output. There are two famous algorithms used by 2FA systems, HMAC-Based One-Time Password Algorithm (HOTP) and Time-based One-Time Password Algorithm (TOTP). The first algorithm is depending on the SHA-1 hash algorithm to generate codes. The input to the SHA-1 is a secrete key and a counter, the secrete key in both sides, the authenticator and the server, also, the counter which counts the number of the loggings must be the same in the both sides as well. Always the generated code may be reduced to 6 to 8 numbers for user convenience. If the server and the client both aware of the secret key and increment the counter evenly at each user input, the resulting code value will be the same, and an OTP will change at each input. Thus, if an attacker intercepts the OTP code, he won't be able to utilize the OTP code again. The TOTP algorithm is based on the HOTP, it uses a time stamp variable instead of counter, it generates an OTP code automatically every 30 seconds. It is known that the output of SHA-1 algorithm is 160 bits length (i.e. 20 characters), but TOTP uses a truncation algorithm to truncate the resultant code to 6 digits. The same thing will happen in both sides, and they generated the same codes every 30 seconds, this will ensure a secure communication between the client and the server. Because TOTP depends on time stamp in generating tokens, and it has an expiration period every 30 seconds, in contrast, HOTP hasn’t such an expiration period, then we may conclude that the TOTP is much better than the HOTP. The authentication process can be summarized as in Fig.1. There must be a secrete key the two sides of the communication agreed on before the authentication process starts, in the Fig.1 the QR-code represents this secrete key. The hash algorithms in both sides, clients and server, uses a combination of the QR-code (the secrete key) and the synchronized time stamp to generate a code of six to eight characters. Then the client sends the code to the server for comparison, the codes in both sides must be identical. After comparing the codes, the authentication process is considered successful if the codes are similar. Then full access to the account is granted to the client. One of the most famous authentication apps are Google Authenticator, it is the most popular app for 2FA. There are others such as Protectimus Smart OTP, Authy 2-Factor Authentication, Microsoft Authenticator, FreeOTP Authenticator, Sophos Authenticator, Authenticator Plus, LastPass Authenticator, SoundLogin, Yubikey, Protectimus Slim NFC. In conclusion, we may mention to the 2016 president Obama editorial article to the Wall Street Journal explaining the need of 2FA and that the passwords alone are not enough to protect consumers and business support that with a survey that 9 of 10 Americans felt that they lost control over their information and accounts. This triggered the process of embedding biometrics in the smartphones as necessary parts of the phone like fingerprints and facial recognition. MFA and 2FA will remain as one of the most powerful protections strategies against attackers to protect information of consumers around the world and we may see more developments in this direction with the technology evolution in future.

Full text

Two-Factor Authentication 2FA: An Overview of HOTP and TOTP Peshawa J. Muhammad Ali [email protected] Two-factor authentication (2FA) is a security process that users must provide two distinct authentication factors to confirm their identity. Usually, the first factor is the traditional password, while the second factor may be unique physical device tokens the user has, such as a mobile app, smart card, or a security token, or it may be biometric data like eye retina, fingerprint data, or a face biometric. 2AF is a member of a bigger family called Multi-Factor Authentication (MFA), which a group of techniques requires the end user to provide more than one credential before gaining access to the applications. The main goal of using 2FA is to provide an extra security shield to protect users’ data and assets. Passwords alone are vulnerable to various attacks, such as brute force, phishing, or password guessing. Even if a password is compromised, an additional factor is required for access, making it more challenging for unauthorized users to gain access to an account or system. The key reasons for using 2FA can be summarized in some points: to enhance the security level of the users’ data, and accounts, the attackers will not be able to log into the account even if they got the password. Users may choose weak passwords, reuse them across multiple sites, or fall victim to phishing attacks. 2FA helps mitigate these risks by requiring a second form of authentication. Some specific applications, like bank transfers, obligatory apply 2AF to protect the customers. Furthermore, 2FA helps prevent unauthorized access to remote access networks, this will strength the security of some sensitive applications, like experiments belongs to the scientific institutions, and remote medical interventions. One of the ways to provide the 2FA is one-time password (OTP), which is a form of multifactor authentication (MFA) and an extra layer of protection. For example, while using a credit card, and making money transaction to another account, the bank sends the customer an OTP code (a number, or a text) through mobile SMS message, and requires the customer to enter it. In this way the bank will make sure that the person using the card is the customer himself not another person. The important thing here is that this code can be used for only one transaction, the same thing will be repeated for all the future transactions. Other ways of MFA may include, answering personal security questions, USB devices, using biometrics, or using OTPs generated by smartphone applications. While talking about the OTPs we must mention hash codes. Because hash code is the technique used to generate the codes of OTP. A hash code is a value generated from a string of text. It is a fixed-size numerical or alphanumeric representation of data that is typically generated by a hash function. Hash functions are algorithms that take input (or 'message') and produce a fixed-size string of characters called a hash code. Famous hash code algorithms are MD5, SHA-1, SHA-2, SHA-3, SHA-256, SHA-512, CRC32…. etc. The common among these algorithms are: they must be deterministic, i.e., produce same output for the same input, irreversible, a small change in the input must produce a big change in the output. There are two famous algorithms used by 2FA systems, HMAC-Based One-Time Password Algorithm (HOTP) and Time-based One-Time Password Algorithm (TOTP). The first algorithm is depending on the SHA-1 hash algorithm to generate codes. The input to the SHA-1 is a secrete key and a counter, the secrete key in both sides, the authenticator and the server, also, the counter which counts the number of the loggings must be the same in the both sides as well. Always the generated code may be reduced to 6 to 8 numbers for user convenience. If the server and the client both aware of the secret key and increment the counter evenly at each user input, the resulting code value will be the same, and an OTP will change at each input. Thus, if an attacker intercepts the OTP code, he won't be able to utilize the OTP code again. The TOTP algorithm is based on the HOTP, it uses a time stamp variable instead of counter, it generates an OTP code automatically every 30 seconds. It is known that the output of SHA-1 algorithm is 160 bits length (i.e. 20 characters), but TOTP uses a truncation algorithm to truncate the resultant code to 6 digits. The same thing will happen in both sides, and they generated the same codes every 30 seconds, this will ensure a secure communication between the client and the server. Because TOTP depends on time stamp in generating tokens, and it has an expiration period every 30 seconds, in contrast, HOTP hasn’t such an expiration period, then we may conclude that the TOTP is much better than the HOTP. Fig.1: explains the algorithms of HOTP/TOTP Source: https://dzone.com/articles/enhancing-security-with-two-factor-authentication The authentication process can be summarized as in Fig.1. There must be a secrete key the two sides of the communication agreed on before the authentication process starts, in the Fig.1 the QR-code represents this secrete key. The hash algorithms in both sides, clients and server, uses a combination of the QR-code (the secrete key) and the synchronized time stamp to generate a code of six to eight characters. Then the client sends the code to the server for comparison, the codes in both sides must be identical. After comparing the codes, the authentication process is considered successful if the codes are similar. Then full access to the account is granted to the client. One of the most famous authentication apps are Google Authenticator, it is the most popular app for 2FA. There are others such as Protectimus Smart OTP, Authy 2-Factor Authentication, Microsoft Authenticator, FreeOTP Authenticator, Sophos Authenticator, Authenticator Plus, LastPass Authenticator, SoundLogin, Yubikey, Protectimus Slim NFC. In conclusion, we may mention to the 2016 president Obama editorial article to the Wall Street Journal explaining the need of 2FA and that the passwords alone are not enough to protect consumers and business support that with a survey that 9 of 10 Americans felt that they lost control over their information and accounts. This triggered the process of embedding biometrics in the smartphones as necessary parts of the phone like fingerprints and facial recognition. MFA and 2FA will remain as one of the most powerful protections strategies against attackers to protect information of consumers around the world and we may see more developments in this direction with the technology evolution in future.