HOTP and TOTP

Two very common implementations of one-time passwords, or OTP, would be HOTP and TOTP.

A one-time password is just a password that you would use once. You're given the password, once you log in then it's no longer valid, or perhaps it expires within a certain time frame.

Two common ways to receive a one-time password would be either through SMS, think of like text messages with this, so if you receive a code through text message to log in and you're given maybe like 15 minutes to log into the system, then that would be an example of SMS. And then there's an authenticator app, an actual app that you would install on your device that would give you these codes.

So here's the thing: whatever the server is expecting, you need to know on your side. So this is your side right here, this is the server side. Now when it comes to SMS, that's pretty straightforward. You have a server here, it sends out a text message to you and you're going to get a text message. In this case it's 134 278, and so you get that text message, you enter it in to authenticate, and now you're logged in because the two match.

But what happens when it's an authenticator app? How does the authenticator app know what the number is compared to what the server has, that they need to be on the same page? And they're not communicating, it's not being sent to the authenticator app. What's happening usually is that the authenticator app generates this number, as well as the server generates this number, and they're on the same page. But how does that happen? Well, HOTP and TOTP are two solutions that help with this. They are two solutions that help coordinate between devices that are not communicating, but be able to come up with the same number.

HMAC-Based One-Time Password

We're going to take a look at HMAC-based one-time password, or HOTP. In order to understand HOTP, we have to understand what a hash is. Essentially there's a hashing algorithm, something that's going to take in data and generate a unique fingerprint, a unique fingerprint in the form of letters and numbers. In this case right here it's some sort of hexadecimal number. It's going to generate this unique fingerprint based off of the data that's put into it.

HOTP is going to hash the key and the counter together to generate this fingerprint right here. So what the key is, is it's a known value, a key that only this server and the authenticator app know what this key is going to be. And then you have a counter, and we'll discuss the counter here in a little bit, but essentially these two get hashed together to create a fingerprint. And then it gets truncated, because this is a very large number right here, so it gets truncated down into the number of digits that you need for the actual authentication. In this case right here this is a six-digit authentication.

The key is exchanged ahead of time, so both the authenticator app and the server know what the key is. And the counter just counts up, so it starts at zero, then 1, 2, 3, 4, 5, 6, 7, and so on and so forth. And so the count number plus the key, or the key and the count, are combined or hashed together, truncated, to come up with these numbers. So then what will happen is every time you generate a new key it will count up. So here's one right here, and then here's two, the second, the third time you log in, the fourth time, the fifth time, the sixth time, and so on and so forth. And so what the server does is keep track of every time that you have logged in, and then it will compare those two.

Now there is a problem with this method. Let's say we're on the counter of three right here, and what happens is we open up the app and we see this number right here, but then we close the app and we don't actually log in. The next time we open up that app it's going to count up, so now we're on four, and then same thing five. If we just keep counting up without logging in, what's going to happen is that the two are going to get off. The authenticator app and the server are going to be off. And so what the server is going to do when you try to log in with 958 675, it could reject you, because the fact is that it's still on three and so it's looking for 034 278.

So there is a look ahead that we can, with this protocol, be able to specify. We're going to look ahead a certain amount of counts ahead, and so now what's going to happen is if we enter in this number right here, it's going to start looking ahead to see if it can find the right one. Once it finds the right one, then it will accept you in. So this is how it compensates for that issue if the counters get off.

Time-Based One-Time Password

Time-based one-time password, or TOTP, is very similar. The only difference is instead of having a counter that counts up every time we try to use one of these numbers, 0, 1, 2, 3, instead we use time. Now there's an equation that this time goes through to calculate it out into this hash. We're not as concerned with whatever algorithm that goes into creating that time, but just realize that what's happening here is the key is combined with time to create that unique fingerprint, that hash, and then it gets truncated down into a smaller number, whatever number that we're looking for.

So now we're using time rather than a counter. So rather than counting up 0, 1, 2, 3, instead what's going to happen is it's going to be based off of time. So we've got 0, 30 seconds, 1 minute, 1 minute 30 seconds, 2 minutes, and so on and so forth.

Now the thing is, it's based off of the system times, so the system times of these two devices could be different. Now hopefully they're syncing to the cloud, so they should be relatively the same, but clocks do get off by a little bit. And so how do we compensate for that? Well, let's say the phone is at this 2-minute mark right here and the server right here is at 1:30. What's going to happen is there's going to be a lookup window, so whatever you type in here, that server is going to compare to plus or minus a certain amount of time. And so as long as your code there lines up with the plus or minus of whatever the server is set up to look in, then you should be good to go.

Syncing the Keys

We still have one unanswered question here, and that is how do we sync these keys? How do we have the same keys on these two devices?

Well, there's two answers to that. One is we could just manually enter it in on the device. We have some sort of authenticator app, and within the authenticator app we would open it up and one of the things it would ask us for is the key. We could enter in that key and then we would have it synced up, the keys on both sides.

Another way is through a QR code. Perhaps we visit a website, and with that website it's going to just display a QR code that's coming from the server. So now we have a QR code, we scan that on our phone into the authenticator app, and what is embedded onto that is information such as the key, on how to set up this connection.