Skip to main content
Cryptography

Return to Answer

Minimal reformatting.
Source Link
e-sushi
e-sushi
  • 18.1k
  • 12
  • 85
  • 235

My opinion on random“Random vs. timeTOTP (Time-based OTP (TOTP)”.

With a random token, you need to keep track of what was generated for whom, when it expires, and you need to purge the expired tokens.

  A (TOTP) has the inherent feature of be being useful for a defined period of time. If

If the server receives an OTP for an account, the server can generate OTPs for that account starting N minutes in the past and work up to the present (or go the other way). IfIf any of those server-generated OTPs match the given OTP, then you know 1) it's valid and 2) it was created within a given time frame in the past. Thereknow…

  1. it's valid and
  2. it was created within a given time frame in the past.

There is nothing else that the server needs to keep track of to validate a TOTP.

My opinion on random vs. time-based OTP (TOTP)

With a random token, you need to keep track of what was generated for whom, when it expires, and you need to purge the expired tokens.

  A (TOTP) has the inherent feature of be being useful for a defined period of time. If the server receives an OTP for an account, the server can generate OTPs for that account starting N minutes in the past and work up to the present (or go the other way). If any of those server-generated OTPs match the given OTP, then you know 1) it's valid and 2) it was created within a given time frame in the past. There is nothing else that the server needs to keep track of to validate a TOTP.

My opinion on “Random vs. TOTP (Time-based OTP)”.

With a random token, you need to keep track of what was generated for whom, when it expires, and you need to purge the expired tokens. A (TOTP) has the inherent feature of be being useful for a defined period of time.

If the server receives an OTP for an account, the server can generate OTPs for that account starting N minutes in the past and work up to the present (or go the other way). If any of those server-generated OTPs match the given OTP, then you know…

  1. it's valid and
  2. it was created within a given time frame in the past.

There is nothing else that the server needs to keep track of to validate a TOTP.

Source Link
md_1976
md_1976
  • 27
  • 3

My opinion on random vs. time-based OTP (TOTP)

With a random token, you need to keep track of what was generated for whom, when it expires, and you need to purge the expired tokens.

A (TOTP) has the inherent feature of be being useful for a defined period of time. If the server receives an OTP for an account, the server can generate OTPs for that account starting N minutes in the past and work up to the present (or go the other way). If any of those server-generated OTPs match the given OTP, then you know 1) it's valid and 2) it was created within a given time frame in the past. There is nothing else that the server needs to keep track of to validate a TOTP.