Do we need one of the factors of two factor authentication to be one-time use?
TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor authentication?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityDo we need one of the factors of two factor authentication to be one-time use?
TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor authentication?
No.
The factors are:
TOTP is not a factor in itself, it is a scheme that can be used to prove that you have the key / device).
There are however other ways of testing that you have something. If you bring a special amulet as "something that you have" then I could simply have a look at it after all. One time use is therefore not required.
No; a common example where neither factor is one-time is SSH key-based authentication with a passphrase: the key is something you have (unless you have memorised it...) and the passphrase is something you know. Both are required for authentication.