google authenticator hotp mode and totp mode

Once the configuration and a seed value are set, the token can be used for TOTP-based two-factor authentication. Seed burning view of the NFC burner 2 Android app The second step is to burn the secret seed for the used TOTP HMAC algorithm onto the card, as shown in the following Figure. If needed, the first step is to edit the general configuration, as the illustrated in the following Figure.Ĭonfiguration view of the NFC burner 2 Android app Phone running the NFC Burner 2 app, the serial number and the current time from the card is read out and displayed. Using the provided software, the token can be configured via NFC. Provided by Token2: A Windows application and an Android app. To configure a card, two software solutions are The two-factor token arrives in an unconfigured state. They contain information about the general operation of the token, the journey of reverseĮngineering some of its functionality, and identified security issues and interesting questions, which could not The following sections summarize the results of our case study concerning this NFC-based TOTP token. The PIN displayed on the e-Ink display cannot be read out via the NFC interface.The card will wipe the configured secret seed when the time (or other configuration parameters) is updated.There are two key differences when compared to the token of Protectimus (see Section Case Study II: Protectimus SLIM NFC): The features of the token are specified by the distributor Token2 as shown in the following screenshot of the corresponding product website. The form factor is identical to a typicalĬredit card. It is designed as a token for TOTP-based two-factor authentication. The NFC-based card OTPC-P2 is distributed by Token2, a Swiss company based in Geneva. The result of our case studies for the Token2 OTPC-P2 and the Protectimus SLIM NFC are provided in Sections Case Study I: Token2 OTPC-P2 and Case Study II: Protectimus SLIM NFC. the used time interval in seconds (time step between TOTPs)īesides software-based TOTP generators like the mobile app Google Authenticator, there are also different kinds of hardware TOTP tokens.ĭuring a research project, we had a closer look at two such RFID-based tokens which support near-field communication (NFC).a cryptographic hash function (digest function).The following TOTP example in Python uses the library PyOTP and illustrates all required configuration parameters for a TOTP: And for implementing TOTPs in software products, a variety of software libraries is available for different programming languages. Protecting user accounts via two-factor authentication (2FA) using a static password and a TOTP is considered a good idea from a security standpoint and a best practice that can prevent different kinds of attacks.įor generating a one-time password, the algorithms described in RFC 4226 titled HOTP: An HMAC-Based One-Time Password Algorithm and RFC 6238 titled TOTP: Time-Based One-Time Password Algorithm are relevant.Ī very popular TOTP generator is the mobile app Google Authenticator. Time-based one-time passwords (TOTP) have been around for several years now and became more and more widespread as authentication factor in multi-factor authentication (MFA) methods.

Google authenticator hotp mode and totp mode