An Effective Method to Enhance Digital System Security — One-Time Password (OTP)

One-Time Password (OTP) is a password that can be used only once. Even if intercepted by an attacker, it cannot be reused for authentication, thus significantly enhancing the security of digital systems.

What Is a One-Time Password (OTP)?

A One-Time Password (OTP) is a password that is easy to enter, requires no memorization, and cannot be reused. It effectively mitigates the security risks associated with leaked passwords and reduces the hassle of password resets due to forgotten credentials. OTPs are typically sent to users via SMS or email, or generated by general-purpose authentication apps. These passwords are usually 4 to 8 characters long, consisting of digits, letters, or alphanumeric combinations. The user simply inputs the received string when authentication is required.

Implementation Methods for OTP

There are two primary methods for generating OTPs: Time-based One-Time Passwords (TOTP) and Hash-based One-Time Passwords (HOTP).

1. Time-based One-Time Password (TOTP)

TOTP, also known as time-synchronized dynamic passwords, is an algorithm that generates OTPs based on the current time and a shared secret key. Its main advantage lies in using time as a dynamic factor, allowing authentication apps to generate codes offline. However, it requires accurate time synchronization and OTPs are only valid within a limited time window.

2. Hash-based One-Time Password (HOTP)

HOTP generates passwords using a shared key and a counter that increments with each request. A new password is created using a hashing algorithm combined with the key and counter. Unlike TOTP, HOTP does not depend on time, so the code doesn’t expire within a time window. However, it does require that the counter value be kept in sync between the authentication app and the server.

3. OTP Delivery Methods

OTPs can be generated by the server and delivered to users via SMS or email. These methods are user-friendly and do not require the user to manage secret keys. However, they depend on network availability and are vulnerable to SMS or email hijacking. Alternatively, OTPs can be generated via authentication apps, which provide better protection against hijacking but require the user to securely store the secret key.

Adding OTP Support to Your System

To help developers implement OTP in their systems and enhance overall security, a utility toolkit is provided to simplify development.

1. Dependency Declaration

Current version: 1.2.2. Replace ${version} with the actual version number.

Maven:

<dependency>
    <groupId>org.nervousync</groupId>
    <artifactId>utils-jdk11</artifactId>
    <version>${version}</version>
</dependency>

Gradle:

Manual: compileOnly group: 'org.nervousync', name: 'utils-jdk11', version: '${version}'
Short: compileOnly 'org.nervousync:utils-jdk11:${version}'

SBT:

libraryDependencies += "org.nervousync" % "utils-jdk11" % "${version}" % "provided"

Ivy:

<dependency org="org.nervousync" name="utils-jdk11" rev="${version}"/>

2. Generating a Random Secret Key

Use the static method generateRandomKey from org.nervousync.utils.OTPUtils. It returns a random Base32-encoded secret key.

Parameters of generateRandomKey:

Name: algorithm

Data Type: String

Description: Secure RNG algorithm. Default: SHA1PRNG

Name: seed

Data Type: String

Description: Base64-encoded seed string. Default: TmVydm91c3luY0RlZmF1bHRTZWNyZXRTZWVk

Name: size

Data Type: int

Description :Key length in bytes. Default: 10

3. OTP Generation and Validation

3.1 TOTP (Time-based OTP)

Since users and servers may be in different time zones, time offset calibration is required before using TOTP to ensure accurate OTP generation and validation.

First, display the generated secret key (as text or QR code) to the user. The user adds it to their authentication app, which then generates OTPs. The user sends the OTP back to the server. The server calculates the time offset using the secret and OTP, then securely stores the offset and secret for future validations.

Calculate Time Offset:

Call the static method calculateFixedTime from org.nervousync.utils.OTPUtils.

Parameters of calculateFixedTime:

Name: calcType

Data Type: OTPUtils.CalcType

Description: Supported: HmacSHA1 (default), HmacSHA256, HmacSHA512

Name: secret

Data Type: String

Description: Base32-encoded secret key

Name: authCode

Data Type: int

Description: OTP entered by the user

Name: syncCount

Data Type: int

Description :Validity period (seconds). Default: 30

Generate TOTP:

Call the static method generateTOTPCode.

Parameters of generateTOTPCode:

Name: calcType

Data Type: OTPUtils.CalcType

Description: Supported: HmacSHA1 (default), HmacSHA256, HmacSHA512

Name: secret

Data Type: String

Description: Base32-encoded secret key

Name: fixedTime

Data Type: long

Description: Time offset value

Name: syncCount

Data Type: int

Description :Validity period (seconds). Default: 30

Validate TOTP:

Call the static method validateTOTPCode.

Parameters of validateTOTPCode:

Name: authCode

Data Type: int

Description: OTP entered by the user

Name: calcType

Data Type: OTPUtils.CalcType

Description: Supported: HmacSHA1 (default), HmacSHA256, HmacSHA512

Name: secret

Data Type: String

Description: Base32-encoded secret key

Name: fixedTime

Data Type: long

Description: Time offset value

Name: syncCount

Data Type: int

Description: Validity period (seconds). Default: 30

Name: fixWindow

Data Type: int

Description :Allowed time window offset. Default: 3

3.2 HOTP (Hash-based OTP)

Generate HOTP:

Call the static method generateHOTPCode.

Parameters of generateHOTPCode:

Name: calcType

Data Type: OTPUtils.CalcType

Supported: HmacSHA1 (default), HmacSHA256, HmacSHA512

Name: secret

Data Type: String

Description: Base32-encoded secret key

Name: randomCode

Data Type: long

Description: Counter value

Validate HOTP:

Call the static method validateHOTPCode.

Parameters of validateHOTPCode:

Name: authCode

Data Type: int

Description: OTP entered by the user

Name: calcType

Data Type: OTPUtils.CalcType

Description: Supported: HmacSHA1 (default), HmacSHA256, HmacSHA512

Name: secret

Data Type: String

Description: Base32-encoded secret key

Name: randomCode

Data Type: long

Description: Counter value