Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

What is the expert cryptographic opinion on the following?

Assume that there is a web server and a client on web page. User on the Client calls an OTP web service on the server which:

  1. creates a RSA key pair
  2. generates a random 10 digit string - the Message
  3. Encrypts the Message with the Public Key component to generate an OTP
  4. Returns the Message and Private Key to Client
  5. Sends OTP via alternate channel (say SMS) to User on mobile

The reason for this kludge is that the web service return can be a script that gets added to the DOM on the fly. The script contains the RSA decrypt method with a built-in Private Key and has the Message as the vallidator. When User enters the OTP into the web page, the vallidator succeeds or not.

The advantage in this method is that the OTP does not need to be stored in a server side database, and there is only one web call-out with the browser doing the validation. However, I am unsure whether RSA was meant to have a private Public Key and a public Private Key.

What is the analysis on whether a malicious user can get the Private key and Message and then compute the OTP? If so, then could I make the OTP entry time bound so as to minimize the attack possibility? Is there a better way to fullfil my requirements?

share|improve this question
2  
What, exactly, are your requirements? In particular, what is that you're trying to achieve with this scheme? It looks like you're trying to authenticate something to something else, but who or what exactly are the parties involves and their roles in this authentication? –  Ilmari Karonen Jan 28 '13 at 15:56
    
I am trying to implement two-factor authentication. The User enters their standard password to access a web site at which point a token is sent via SMS to their mobile device. They enter the token as the second factor. I am trying to implement the second factor verification entirely on the web client. –  MasterBlaster Jan 29 '13 at 2:51
1  
And why should the server trust the results of whatever verification the client does (or claims to have done)? –  Ilmari Karonen Jan 29 '13 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.