Retrieve timestamp from TOTP value

Question

TOTP (Time-based One-Time Password) as I understand is an algorithm that uses the current time as a variable along with a shared key to generate a secured token. Wiki page for reference: http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm

What I wanted to know is whether it is possible to determine the timestamp data (time + timezone) from a particular TOTP value? I can generate the shared key which was used to generate the TOTP value.

The problem I'm facing is that we make use of TOTP to perform validations between our offline Android/iOS clients and our server. However, once in a while we encounter a user whose TOTP tokens fail to authenticate. We ask them the same sundry questions about current time synchronisation and to check their timezone. Often times, users have a hard time determining even this.

So, I was wondering whether I could simply work out the timestamp + tz information myself from the faltering TOTP token, provided I have access to the shared key used to generate the said TOTP token.

Thanks for reading and any help would be greatly appreciated.

Answer 1

In theory, it is not:

TOTP, like HOTP, is based on a Hash-based message authentication code (HMAC),
which in turn relies on a cryptographic hash.

Both the key, and the HMAC message (a time counter in TOTP) are hashed using the specified cryptographic hash.

One key goal of cryptographic hashes is:

• it should be infeasible to generate a message that has a given hash

By definition, TOTP uses the SHA-1 hash function, which can be considered reasonably secure in this context.
Thus, it is impossible to determine either the key, or the time counter from just the hash value, even less so from the TOTP result, which is only a truncated part of the hash value.

In practice, maybe:

If you know the key you can itterate through a set of likely time counter values (e.g. now +/- one minute; now +/- x hours for timezone issues) and find the correct time counter value.

In fact, this is a variation of a brute force attack, with a limited set of likely inputs.