0
$\begingroup$

Do we need one of the factors of two factor authentication to be one-time use?

TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor authentication?

Improve this question
$\endgroup$
1
$\begingroup$

No.

The factors are:

  • something you know (for instance a password);
  • something you have (for instance a device containing a key for TOTP generation)
  • something that you are (for instance a fingerprint).

TOTP is not a factor in itself, it is a scheme that can be used to prove that you have the key / device).

There are however other ways of testing that you have something. If you bring a special amulet as "something that you have" then I could simply have a look at it after all. One time use is therefore not required.

Improve this answer
$\endgroup$
0
$\begingroup$

No; a common example where neither factor is one-time is SSH key-based authentication with a passphrase: the key is something you have (unless you have memorised it...) and the passphrase is something you know. Both are required for authentication.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.