computer science

Time-based one-time password

Time-based one-time password is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Time-based one-time password rather than just read about it. In short: Time-based one-time password (TOTP) is a computer algorithm that generates a one-time password (OTP) using the current time as a source of uniqueness. As an extension of the HMAC-based one-time password (HOTP) algorithm, it has been adopted as Internet Engineering Task Force (IETF) standard RFC 6238.

Key takeaways

Time-based one-time password belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Time-based one-time password to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Time-based one-time password from memory before moving on to harder problems.

Reference excerpt

Time-based one-time password (TOTP) is a computer algorithm that generates a one-time password (OTP) using the current time as a source of uniqueness. As an extension of the HMAC-based one-time password (HOTP) algorithm, it has been adopted as Internet Engineering Task Force (IETF) standard RFC 6238. TOTP is a cornerstone of the Initiative for Open Authentication (OATH) and is used in a number of two-factor authentication (2FA) systems.

History Through the collaboration of several OATH members, a TOTP draft was developed in order to create an industry-backed standard. It complements the event-based one-time standard HOTP, and it offers end user organizations and enterprises more choice in selecting technologies that best fit their application requirements and security guidelines. In 2008, OATH submitted a draft version of the specification to the IETF. This version incorporates all the feedback and commentary that the authors received from the technical community based on the prior versions submitted to the IETF. In May 2011, TOTP officially became RFC 6238.

Algorithm To establish TOTP authentication, the authenticatee and authenticator must pre-establish both the HOTP parameters and the following TOTP parameters:

T0, the Unix time from which to start counting time steps (default is 0), TX, an interval which will be used to calculate the value of the counter CT (default is 30 seconds). Both the authenticator and the authenticatee compute the TOTP value, then the authenticator checks whether the TOTP value supplied by the authenticatee matches the locally generated TOTP value. Some authenticators allow values that should have been generated before or after the current time in order to account for slight clock skews, network latency and user delays. TOTP uses the HOTP algorithm, replacing the counter with a non-decreasing value based on the current time: TOTP value(K) = HOTP value(K, CT), calculating counter value C T = ⌊ T − T 0 T X ⌋ , {\displaystyle C_{T}=\left\lfloor {\frac {T-T_{0}}{T_{X}}}\right\rfloor ,} where

CT is the count of the number of durations TX between T0 and T, T is the current time in seconds since a particular epoch, T0 is the epoch as specified in seconds since the Unix epoch (e.g. if using Unix time, then T0 is 0), TX is the length of one-time duration (e.g. 30 seconds).

otpauth:// URI scheme

Some implementations of TOTP for smartphones allow users to scan QR codes to add HOTP and TOTP tokens to their authenticator apps. These QR codes contain Uniform Resource Identifiers (URIs) with the scheme otpauth://. TOTP otpauth:// URIs begin with otpauth://totp/ and must contain a label and secret. The label is encoded as part of the path, while the secret is encoded as query parameters. The URI may optionally contain other fields, such as the number of digits (which defaults to 6), the algorithm used (which defaults to SHA1), the period (which defaults to 30 seconds), and the issuer name. The secret is encoded as RFC 4648 Base32, with padding omitted. For example, the URI otpauth://totp/Wikipedian?secret=JBSWY3DPFQQHO33SNRSCC represents a TOTP token labeled "Wikipedian" with the secret Hello, world! encoded as ASCII.

Security Unlike passwords, TOTP codes are only valid for a limited time. However, users must enter TOTP codes into an authentication page, which creates the potential for phishing attacks. However, due to the short window in which TOTP codes are valid, attackers must proxy the credentials in real time. TOTP credentials are also based on a shared secret known to both the client and the server, creating multiple locations from which a secret can be stolen. An attacker with access to this shared secret could generate new, valid TOTP codes at will. This can be a particular problem if the attacker breaches a large authentication database.

See also Botan (programming library) FreeOTP Google Authenticator multiOTP Comparison of TOTP applications

References

Illustrations

Worked examples

Example 1 — a first encounter with Time-based one-time password

Start with the simplest possible case. Write down what Time-based one-time password claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Time-based one-time password before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Time-based one-time password ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Time-based one-time password

In research: Time-based one-time password appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Time-based one-time password in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Time-based one-time password is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer access control, Cryptographic algorithms, Internet protocols, so understanding it makes those chapters shorter.
In everyday life: Look for Time-based one-time password outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Time-based one-time password in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Time-based one-time password means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Time-based one-time password out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Time-based one-time password in simple terms?

Why does Time-based one-time password matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Time-based one-time password?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Time-based one-time password.