Do we need one of the factors of two factor authentication to be one-time use?
TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor authentication?
$\begingroup$
$\endgroup$
$\begingroup$
$\endgroup$
No.
The factors are:
- something you know (for instance a password);
- something you have (for instance a device containing a key for TOTP generation)
- something that you are (for instance a fingerprint).
TOTP is not a factor in itself, it is a scheme that can be used to prove that you have the key / device).
There are however other ways of testing that you have something. If you bring a special amulet as "something that you have" then I could simply have a look at it after all. One time use is therefore not required.
answered Aug 23 '18 at 4:36
$\begingroup$
$\endgroup$
No; a common example where neither factor is one-time is SSH key-based authentication with a passphrase: the key is something you have (unless you have memorised it...) and the passphrase is something you know. Both are required for authentication.
