Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that.

I have a question about one-time codes being used with passwords. What inspires me to ask this question is that some prominent government computing agencies (NERSC in particular) has implemented multi-factor authentication. I have google authenticator setup to generate my OTP codes.

The method they show requires one to input the password and the OTP in separate fields. However, in different places I noticed they require 'password+OTP', which led me to discover that this works site-wide, one can just concatenate the OTP to the end of the password and everything works fine.

Which bring me to my real question: Is that vulnerable to timing attacks? The only way I can imagine this to work is by iterating through my supplied password, and checking for a match to the hash/whatever of the password up to the checked point, which as far as I know would let someone time-attack a password out, as theoretically NERSC would not know the length of your password, and thus not know what part of the concatenated password+OTP is password and what is OTP, which leaves brute-force to check if it's a valid password and OTP.

Is this valid logic, or is there something I don't know? I haven't checked if its actually timing attack resistant since it's government property... (they could just wait a set time to return if the password is correct or not?). Is this a concern I should send to the powers that be because there is a better way to do it or am I just a clueless but paranoid beginner?

  • $\begingroup$ Any site that allow you to add the OTP to the password will usually use a fixed length OTP, and could use a constant time check if the last characters match your account's current OTP string. In parallel they can separately check if the supplied password matches the account password. This can be tested with both the full password and with the potential OTP cut off. If the full password string OR password + OTP checks out, you get logged in (and this evaluation happens last of all, and is the only source of timing the adversary sees). Each individual computation always takes equally long time. $\endgroup$ – Natanael Mar 30 at 1:10
  • $\begingroup$ Keep in mind that my comment above only shows it can be timing sidechannel resistant. A poor implementation could indeed be insecure. $\endgroup$ – Natanael Mar 30 at 1:11
  • $\begingroup$ @Natanael, I can't up vote comments but thanks! Parallel makes sense for constant time. $\endgroup$ – MadisonCooper Mar 30 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.