HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What advantages it introduces?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
One of the advantages is purely on the human side of security. From RFC 6238's abstract:
The TOTP passwords are short-lived, they only apply for a given amount of human time. HOTP passwords are potentially longer lived, they apply for an unknown amount of human time.
The reference to "enhanced security" is referencing (at least) two areas: The value of a compromised key, and ability to attack one.
First, should a current HOTP password be compromised it will potentially be valid for a "long time". Ensuring frequent use of the HOTP in human time is not a part of the HOTP design, so it is unknown how long the current HOTP password will be valid for and we have to assume the worst case, namely, that it will be a "long" time. This allows the attacker to use a compromised password at their leisure. But should the current TOTP be compromised, it will not be useful for very long because in one TOTP time increment it will be invalidated. Of course, in theory the attacker could grab and use the password in negligible time, but it does prevent a practical human aspect. For example, someone who gets a look at your current Paypal key (which rotates every 30 seconds, IIRC) can't go home and try to use it later, they would have to lunge for a computer in the moment. Someone who compromises they key may not realize it until after the key has expired. Etc.
Second, if you are attacking a key, your work is potentially invalidated or set back every time increment of the TOTP because the target has moved. Perhaps an attacker has discovered an attack against an OTP scheme that allows them to predict the next password only if they have some number of the last 10 passwords, but it takes about 2 hours of computing time to do so. If the OTP changes every minute, their attack is pretty much useless. Brute-force attacks are inhibited as well, because the next password is chosen the same distribution each time; it is possible to brute-force exhaust the password space and not find the password. TOTP doesn't eliminate those sorts of attacks, but hopefully it limits which ones have the ability to be effective.
Neither is worthwile. Changing number codes were invented by RSA in 1984 to block keyloggers. More than 90% of todays internet breakins take place as a result of phishing, and we're seeing incidence of entire countries having more malware infected machines than clean ones (the boleto bandits, have pocketed $1bn cash so far, & are still going strong).
TOTP and HOTP are almost completely ineffective against todays' risks.
You need solutions that include mutual authentication, and transaction verification, not 30-years-old gizmos.