3 ms·

I don't think it is solely based on time. Did you read my comment carefully?

marshray 14y ago
I have implemented HOTP/TOTP. HOTP is based on the secret seed and a counter value (e.g., button presses). TOTP substitutes time for the counter value. I read your comment carefully and it didn't make any sense to me. The other way I thought is the code must be self-verifiable. No, code verification requires knowledge of the secret seed value.
- zhuzhuor 14y ago
  Please read my comment to @danielpal. By self-verifiable I mean the half of the code is a random number, the other half is computed based on the secret seed and the random number. I guess another way without frequent sync is to generate a new code every sec, and the server check if it's one of the 25 codes in the last 25 seconds. But this might be unnecessary and inefficient.
  - marshray 14y ago
    By self-verifiable I mean the half of the code is a random number, the other half is computed based on the secret seed and the random number. Yeah, TOTP doesn't do that. I guess another way without frequent sync is to generate a new code every sec, and the server check if it's one of the 25 codes in the last 25 seconds. But this might be unnecessary and inefficient. Here's how it actually works: The auth code is generated entirely by: 1. The algorithm documented in RFC 4226 and 6238, 2. static preconfigured parameters of that implementation (e.g., SHA-1, 30s, 6 digits), 3. the secret seed for that token, and 4. the current time. For a given token, (4) is the only thing that changes to generate new codes.
    - zhuzhuor 14y ago
      You didn't get my point... I know what it is based on, except the implementation details. My question was what's the mechanism to verify the code refreshed every time the screen is turn on (which is a little different from other authenticators).
      - marshray 14y ago
        So if you turned the screen off and on every 1 second, you'd get a different code every single time? I don't think there's a reasonable way to do that within the TOTP specification. There's (eventually) got to be some rate-limiting or it will reduce the security.

I have implemented HOTP/TOTP. HOTP is based on the secret seed and a counter value (e.g., button presses). TOTP substitutes time for the counter value. I read your comment carefully and it didn't make any sense to me. The other way I thought is the code must be self-verifiable. No, code verification requires knowledge of the secret seed value.

zhuzhuor 14y ago
Please read my comment to @danielpal. By self-verifiable I mean the half of the code is a random number, the other half is computed based on the secret seed and the random number. I guess another way without frequent sync is to generate a new code every sec, and the server check if it's one of the 25 codes in the last 25 seconds. But this might be unnecessary and inefficient.
- marshray 14y ago
  By self-verifiable I mean the half of the code is a random number, the other half is computed based on the secret seed and the random number. Yeah, TOTP doesn't do that. I guess another way without frequent sync is to generate a new code every sec, and the server check if it's one of the 25 codes in the last 25 seconds. But this might be unnecessary and inefficient. Here's how it actually works: The auth code is generated entirely by: 1. The algorithm documented in RFC 4226 and 6238, 2. static preconfigured parameters of that implementation (e.g., SHA-1, 30s, 6 digits), 3. the secret seed for that token, and 4. the current time. For a given token, (4) is the only thing that changes to generate new codes.
  - zhuzhuor 14y ago
    You didn't get my point... I know what it is based on, except the implementation details. My question was what's the mechanism to verify the code refreshed every time the screen is turn on (which is a little different from other authenticators).
    - marshray 14y ago
      So if you turned the screen off and on every 1 second, you'd get a different code every single time? I don't think there's a reasonable way to do that within the TOTP specification. There's (eventually) got to be some rate-limiting or it will reduce the security.