Time-based One-time Password Algorithm

TOTP - Time-based One-time Password Algorithm is an extension of the HMAC-based One Time Password algorithm HOTP to support a time based moving factor. TOTP is an Internet Engineering Task Force standard[1] and a cornerstone of Initiative For Open Authentication (OATH).

Contents

Applications

TOTP can be used to authenticate a user in a system via an authentication server. If some more steps are carried out, the user can also authenticate the validation server.

History

A TOTP draft was developed through the collaboration of several OATH members in order to create an industry-backed standard. It complements the event-based one-time standard HOTP and offers end user organizations and enterprises more choice in selecting technologies that best fit their application requirements and security guidelines. In 2008, OATH submitted a draft version of the specification to the IETF. This version incorporates all the feedback and commentary that the authors received from the technical community based on the prior versions submitted to the IETF.[2] In May, 2011, TOTP officially became RFC 6238.[1]

Implementations

Google has implemented a version of TOTP in their Google Authenticator which is the basis of its two-factor authentication.[3]

See also

References

  1. ^ a b "RFC 6238 - TOTP: Time-Based One-Time Password Algorithm". http://tools.ietf.org/html/rfc6238. Retrieved July 13, 2011. 
  2. ^ Alexander, Madison. "OATH Submits TOTP: Time-Based One Time Password Specification to IETF". Open Authentication. http://www.openauthentication.org/news/20080408. Retrieved 22 February 2010. 
  3. ^ "google-authenticator - Project Hosting on Google Code". http://code.google.com/p/google-authenticator. Retrieved 22 February 2010. 

External links