What is a Time-Based One-time Password (TOTP)?

Time-based One-time Password (TOTP) is a widely adopted method for two-factor authentication. It generates unique, time-limited codes using a shared secret key and the current time.

TOTP offers several advantages over SMS-based authentication, including offline capability, increased security, and privacy protection. This blog explores the inner workings, implementation, benefits, and drawbacks of TOTP as a robust authentication solution.

What is a TOTP?

A Time-based One-time Password (TOTP) is a type of two-factor authentication (2FA) that enhances the security of logging into online accounts. It offers an extra level of security that goes beyond conventional static passwords, which are vulnerable to many types of attacks, including phishing, keylogging, and password guessing.

TOTP is often used in combination with a primary authentication factor, such as a username and password, to create a multi-factor authentication system.

How Does TOTP Work?

TOTP is based on a shared secret key that is known to both the user's device (typically a mobile app or hardware token) and the authentication server.

This secret key is generated during the initial setup process. It is used in conjunction with the current time to generate a one-time password (OTP) that is valid for a short period, typically 30 or 60 seconds.

The TOTP algorithm uses the following inputs to generate the one-time password:

1. Shared Secret Key: A unique, cryptographically secure key that is shared between the user's device and the authentication server during the initial setup.
2. Time-based Value: A value based on the current time, typically the number of time intervals (e.g., 30-second intervals) since a predefined starting point.

The TOTP algorithm combines these two inputs using a hash-based message authentication code (HMAC) algorithm, such as SHA-1 or SHA-256, to generate a one-time password. The resulting OTP is typically a 6-digit or 8-digit code that is displayed on the user's device or token.

During the authentication process, the user enters the OTP. The authentication server creates an OTP using the same shared secret key and the present time. The user receives access if the OTP they entered matches the OTP the server-generated. If the OTPs do not match, access is denied.

TOTP vs SMS

TOTP is often compared to SMS-based two-factor authentication, where the one-time code is sent to the user's mobile phone via text message. While both methods provide an additional layer of security, TOTP has several advantages over SMS-based 2FA:

• Offline Capability: TOTP does not require an internet connection or cellular network connectivity to generate and verify OTPs. This improves reliability and accessibility in locations with weak network coverage or during network outages.

In contrast, SMS-based 2FA relies on cellular network availability and can be disrupted by network issues or outages.

• Increased Security: TOTP is less susceptible to certain types of attacks, like SIM swapping or man-in-the-middle attacks, that can compromise SMS-based 2FA. Additionally, TOTP does not rely on the security of the cellular network, which can be vulnerable to attacks like SS7 vulnerabilities.

These vulnerabilities in the cellular network infrastructure can potentially allow attackers to intercept and divert SMS messages, compromising the security of SMS-based 2FA.

• Privacy: TOTP does not require users to provide their phone numbers, which can be considered sensitive personal information. SMS-based 2FA, on the other hand, necessitates the sharing of phone numbers with the service provider.
• User Experience: TOTP is generally faster and more convenient than waiting for an SMS message to arrive, especially in areas with poor cellular coverage. The one-time code is immediately available on the user's authenticator app or token, enabling a smoother login experience.

TOTP Implementation

TOTP can be implemented using either hardware tokens or software-based authenticator apps on mobile devices.

1. Hardware Tokens: These are dedicated physical devices that generate TOTP codes and display them on a built-in screen. Hardware tokens offer an additional layer of security as they are separate from the user's primary device (e.g., a smartphone or computer). However, they can be more expensive and inconvenient to carry around.
2. Authenticator Apps: These are mobile applications that can generate TOTP codes for multiple accounts or services. Popular authenticator apps include Google Authenticator, Authy, Microsoft Authenticator, and LastPass Authenticator.

Authenticator apps are widely available, easy to use, and often offer additional features like cloud backup and multi-device synchronisation.

The initial setup process for TOTP typically involves the following steps:

1. The user registers for TOTP authentication with a service or website.
2. The service generates a shared secret key and provides it to the user in the form of a QR or a manual entry code.
3. The user scans the QR code or manually enters the code into their authenticator app or hardware token.
4. The authenticator app or token stores the shared secret key and is now ready to generate TOTP codes for that service.

During subsequent logins, the user enters the TOTP code displayed on their authenticator app or token along with their primary credentials to gain access to the service.

Benefits and Drawbacks of TOTP

Benefits of TOTP

• TOTP adds an additional layer of security beyond traditional static passwords, making it harder for attackers to gain access to accounts.
• TOTP provides a second factor of authentication, following the principle of multi-factor authentication, which is widely recognised as a best practice for secure authentication.
• TOTP operates offline without the internet, making it reliable and accessible during poor network coverage or network failures.
• TOTP does not require sharing personal information like phone numbers, as is the case with SMS-based 2FA.
• TOTP is generally faster and more convenient than waiting for an SMS message to arrive, especially in areas with poor cellular coverage.

Drawbacks of TOTP

• TOTP relies on the user having access to their authenticator app or token. Loss or theft of the device containing the authenticator app or token can compromise security until the authenticator is reset or replaced.
• TOTP requires a separate setup process for each service or account, which can be time-consuming and inconvenient if the user has many accounts.
• Both the user and the service provider must securely store and manage the shared secret keys used for TOTP generation. Improper key management can lead to security vulnerabilities.
• Users may need to be educated on the importance of protecting their authenticator app or token, as well as the risks associated with losing or sharing the device.

TOTP Standards and Adoption

TOTP is an open standard defined in RFC 6238 by the IETF (Internet Engineering Task Force). It is widely adopted by major technology companies, financial institutions, and online services as a preferred method for two-factor authentication.

Token-based one-time password (TOTP) authentication is accepted by a wide variety of well-known online enterprises, including Google, Microsoft, Amazon, and GitHub, using authenticator applications or physical tokens.

Additionally, TOTP is often used in enterprise environments to secure access to resources and applications, which protects user accounts and sensitive data.

TOTP and Multi-Factor Authentication (MFA)

TOTP is often used as part of a multi-factor authentication (MFA) strategy, which combines two or more independent factors to authenticate a user. MFA generally comprises the following three kinds of authentication factors:

1. Knowledge Factor: Something the user knows, like a password or personal identification number (PIN).
2. Possession Factor: Something the user has, such as a TOTP code generated by an authenticator app or token.
3. Inherence Factor: Something the user is, such as biometric data like fingerprints, facial recognition, or voice recognition.

By combining TOTP (a possession factor) with a traditional password (a knowledge factor), organisations can implement a robust two-factor authentication system. Some authentication solutions even incorporate biometric factors like fingerprint or facial recognition, further strengthening the authentication process.

In addition to TOTP, other possession factors used in MFA include:

• SMS-based one-time passwords (OTPs)
• Push notifications to mobile apps
• Hardware security keys (e.g., YubiKey, Google Titan Security Key)
• Smart cards or physical tokens

The choice of authentication factors often depends on the organisation's security requirements, user experience considerations, and the availability of various authentication methods to the target user base.

Conclusion

TOTP, meaning Time-based One-time Password, provides a secure and user-friendly method for enhancing the security of online accounts through two-factor authentication. By combining a shared secret key with the current time, TOTP generates unique, time-limited codes that are difficult to compromise.

TOTP is a popular and efficient authentication and account protection solution as cybersecurity threats increase. The incorporation of it with Instasafe's multi-factor authentication improves organisation and service provider security.

Moreover, Instasafe solutions protect sensitive data, privacy, and peace of mind by shielding your accounts with industry-leading protection.

Frequently Asked Questions(FAQs)

1. What is an OTP-based password?

An OTP (One-Time Password) based password is a temporary, single-use code that serves as an additional authentication factor along with a traditional password.

2. What is the meaning of TOTP?

TOTP stands for Time-based One-Time Password. It is a type of OTP that is generated based on the present time and a shared secret key between the user's device and the authentication server. TOTP codes are valid for a short period, typically 30-60 seconds.

3. What is the one-time password method?

A one-time password method is a form of multi-factor authentication that involves generating a unique, time-sensitive code that must be entered along with a traditional password or other credentials. This temporary code adds an extra layer of security by requiring a 2FA (second factor of authentication).