6
$\begingroup$

I would like to better understand why some people use the term One Time Password and other Authentication Token.

I have noticed that in academic circles, there is a differentiation between authenticated tokens (say a nonce and the signature of the nonce) vs. OTP's, which I always saw as a family of such tokens, one that is either hardware or software aided, using some shared secret or seed and not a certificate itself.

In industry, I hear more and more people calling authenticated tokens OTP's.. I actually start doubting myself, and could not find much material online that compares or even defines both. So I wonder the following:

  • What is the difference if any, between these 2 concepts?

  • Can I use the terms interchangeably?

  • Are there standards that define what an OTP is and what it should look like?

Improve this question
$\endgroup$
1
  • $\begingroup$ I'm guessing it's loose use of terms, and context is used to distinguish any other meaning of "authentication token". In the simplest context, AFAIK, both mean the same thing, which is usually a 6-digit code that changes every 30 or 60 seconds. The "token" word could have come from en.wikipedia.org/wiki/Security_token when it is a physical device, so you could say that's a specific type of OTP-generator (as opposed to an app like AndOTP or Aegis on your mobile, for instance). Corrections welcome. $\endgroup$
    – user30713
    Commented Jul 28, 2020 at 3:25

2 Answers 2

Reset to default
1
$\begingroup$

Authentication token is used in accessing APIs, for example if you want to add some new features to you website, you can just use the API with the authentication token and things would work. In a way you are using API providers services in your website with minimal effort. OTP on the other hand is just a method of verifying you identity, this typically expires within seconds or minutes. Authentication token are server generated keys which do not expire for a long time, until the managing server wants to. There are plenty of API developing companies, open source too

Improve this answer
$\endgroup$
0
$\begingroup$

A token is the collective data that is used to produce one time passwords, and whilst OTP codes typically change every 30 or 60 seconds, the token seed data itself does not.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.