Currently we have implemented One Time Passwords (OTP) as second authentication which works well. We use TOTP - RFC 6238
Some clients would like to have a "sms only" login, so it's single factor authentication. In the some cases (dependent of the data) that is fine. We will send the token via SMS and it won't have to be OTP-app compatible (e.g. Google Authenticator)
To our opinion the RFC 6238 (TOTP) is too weak for single factor authentication as the time component gives issues:
- If the password is 30 seconds long, two login attempts in the the 30 seconds period will give the same password
- If we change the time to 1 sec, we have to check multiple "frames"
- Also, alphanumeric characters in the password isn't compatible with the RFC?
We are also aware there is a counter based algorithm (HOTP - RFC 4226), but their could be security issues if we won't sync the counter correctly (between servers).
So we are looking for a RFC to generate one time passwords with the following requirements:
- Generate passwords, time based, no counter
- Generate passwords with alphanumeric and numeric characters
The flow will be:
- Generate OTP
- Store the password in (server-side) session (including expiration)
- Check the token and clear the session.
We could use the following code to create a OTP
- Generate random (secure) bytes
- Convert to text
But that isn't compliant to a RFC, and RFC-compliance is preferred.
- Is there another RFC we could use that satisfies the requirements?
- Are we RFC 6238 compliant if we: generate the TOTP with a short time (e.g. 1 sec), and store the result in session.