So we have the need for using a TOTP to generate a code on the server to send to a mobile client, I have been testing code generation with the following 3 java repos:

I've taken the core TOTP generating code and I've been testing them. My issue is that I will run the arbitrary mvn unit test where using the default time step of 30 secs, I will generate a token (t0), wait 2 seconds, and generate another token (t1) and sometimes (like 1 of every 10 tries) t0 != t1. I can't figure out why this is and my math-fu is not at the level to fully grasp whether this is expected or whether I am doing something wrong.

Note that this happens for all the 3 code sources (i haven't changed the code except for providing the secret key) I mentioned above - clearly either i'm doing something wrong or this behavior is possibly expected?!


1 Answer 1


If the time step is 30 seconds, there is a 2/30 = 1/15 probability that your starting time will be a different time step from the ending time two seconds later.

  • $\begingroup$ i didn't get that, can you elaborate? Maybe I don't understand how TOTP works - if i generate a token at T0, i expect that (on the same machine) if i generate a token T1 two seconds after T0 and I have 30 seconds from the time i generated T0 to verify then T1 (which I generated 2 seconds after T0) should be the same and match. $\endgroup$ May 27, 2018 at 17:40
  • $\begingroup$ To further explain my use case: i generate a token (T0) on the server, send it to a mobile device (via SMS), the device then calls the server with the token it received at which point the server will generate another token (T1) and if T0 == T1 then we authenticate the device. I assume this methodology is valid. $\endgroup$ May 27, 2018 at 17:44
  • $\begingroup$ The timer doesn't start when you generate the token. The timer starts on the epoch January 1, 1970, and the token is a function of the number of full 30-second time steps since the epoch. About 1/15 of the time, if you wait two seconds between generating two tokens, you will cross one of those time step boundaries. $\endgroup$ May 27, 2018 at 17:51
  • $\begingroup$ Ahhhh I got it, I was misunderstanding how TOTP works can I add a follow up to this @squeamish-ossifrage - why, in your opinion, is TOTP better than me generating a secure-random 6 digit token and managing the 30 sec life from that point onward, I will thereby eliminate the 1/15 probability. Certainly I'm not the first to think of doing this but still TOTP exists so there must be a reason why it is done rather than using a secure-random 6 digit token - maybe you can enlighten me (or should i follow protocol and post as a diff question) $\endgroup$ May 27, 2018 at 18:09
  • $\begingroup$ How does the {client, server} know at which precise nanosecond the {server, client} generated its token in order to match that one, for the next thirty seconds? $\endgroup$ May 27, 2018 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.