Questions tagged [two-factor-authentication]

Two-factor authentication (2FA) is a security system that requires two distinct forms of identification in order to access something. Two-factor authentication can be used to strengthen the security of an online account, a smartphone, or even a door.

Filter by
Sorted by
Tagged with
1 vote
0 answers
51 views

Secure two-factor authentication app for iOS

I'm working on an open source iOS-native (both UX- and implementation-wise) 2FA app. Two of primary goals for the project are ensuring security and simple backups. Addressing these two areas is the ...
Greg Navis's user avatar
7 votes
1 answer
175 views

Why did Yubico changed U2F Key Derivation method on YubiKey?

Previous: https://web.archive.org/web/20160102181336/developers.yubico.com/U2F/Protocol_details/Key_generation.html https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ $$ PrivateKey = \operatorname{...
youfu's user avatar
  • 253
0 votes
1 answer
48 views

Alternative to physical aspect of security

To answer my question, imagine a device that has some sort of secret(s) (stored on a crypto coprocessor), that is encrypted with some sort of symmetric encryption (like AES). If to make this device ...
Zero's user avatar
  • 101
2 votes
0 answers
104 views

Difference between fuzzy vault and fuzzy commitment?

https://dl.acm.org/doi/10.1145/2905055.2905118 Quoting the above paper's abstract, "Biometric cryptosystem can apply fuzzy vault, fuzzy commitment, helper data and secure sketch, whereas, ...
Chirag Parmar's user avatar
4 votes
2 answers
305 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
Yash Dhingra's user avatar
2 votes
0 answers
24 views

Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?

Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
Z.P.'s user avatar
  • 353
2 votes
1 answer
622 views

What time is used in a TOTP counter?

I am currently working on a desktop TOTP client. From the TOTP spec at https://www.rfc-editor.org/rfc/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time). But what is &...
M4X_'s user avatar
  • 145
3 votes
1 answer
100 views

I don't want to store passwords, can I use them as an encryption key for another field?

I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely). So here's the deal, say I don't want to store passwords because that opens me up to all sorts of ...
Der Kommissar's user avatar
2 votes
2 answers
273 views

Authentication without decrypting the password?

To my knowledge it works like this: The server receives the username-password values over a secure & encrypted channel. The username-password values are decrypted in the server and are present as ...
AleksanderCH's user avatar
  • 6,425
0 votes
2 answers
54 views

Does two-factor authentication require one time use of one of the factors?

Do we need one of the factors of two factor authentication to be one-time use? TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor ...
Wei Wen's user avatar
  • 305
3 votes
1 answer
582 views

Is using a smart card and password two-factor authentication?

I use a smart card - as read only device - for user identity as well as a password: The smart card (holds the user ID) is something I have; The password is something I know. Is this still two-factor ...
Wei Wen's user avatar
  • 305
1 vote
1 answer
82 views

Re-using information from the first factor for the second factor

Is it safe to re-use my username and password as information for the 2nd-factor? For instance: the first factor is the username and password; the second factor is $H(H(username) \oplus H(password \| ...
Wei Wen's user avatar
  • 305
8 votes
4 answers
1k views

Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?

The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you ...
user371366's user avatar
3 votes
3 answers
2k views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
Arvind Sasikumar's user avatar
4 votes
2 answers
252 views

Is there a perpetual 2-factor-authentication scheme that allows temporary password generation?

Recall that current forms of two-factor authentication (2FA) rely on: Something you know, i.e. your password Something you have, i.e. your one-time password (OTP) generator on a trusted device The ...
user541686's user avatar
  • 1,349