Implementing Secure OTP

Transcript

1. Implementing Secure OTP M a rvin Collins Hose a
2. What Is OTP • One time password • Multi-factor auth • TOTP • Used by many tech company, like google • Used to hence security
3. OTP algorithm examples • RFC 6238 - time based OTP • HMAC-based (RFC 4226) counter based OTP, • hash-based message authentication codes • Cryptographic function and cryptographic key • TOTP is based on counter based OTP M a ke it secure
4. HMAC • The HOTP value is the human-readable design output, a d-digit decimal number (without omission of leading 0s): • HOTP value = HOTP(K, C) mod 10d • C = counter • Key = K • Method default SHA-1 • The least signi fi cant value d
5. Recovery • TOTP is based on device which can be lost, stolen or damaged When you’re locked out
6. There is another way • You can use SMS to send OTP to the user phone number • This is still based on the algorithm that we’ve used in the application SMS
7. Let’s Now Code • Basic OTP • HMAC-based (RFC 4226) counter based OTP, • Africa Is Talking SMS integration • Sending OTP SMS