Screenshots:
TOTP on Android
Time-based One-time Password Algorithm is an expansion of the HOTP algorithm that uses time as the "moving counter" instead of a normal counter. Still is draft at the time of publishing, I decided that it would not be too difficult to add this to the mOTP application that is currently in the market. A brief description of TOTP can be found on wikipedia and the full current specification here. Since I already went through the trouble of making mOTP have a multiple OTP framework, all I had to do was add a class and some error checks in the setup page. I will upload the apks soon, but they are already available on the market.
Screenshots:
Screenshots:
Subscribe to:
Post Comments (Atom)
12 comments:
OK, after some more extensive testing... I am beginning to wonder if I am misunderstanding whether your hotp support in your Android application works or if it is my fault that it is not working. Perhaps you can help me out. Here's what I am trying to do.
The set up is otpd (open source hotp compliant daemon) running alongside of freeradius which has an otpd_module. I have used various hardware tokens and they all work.
The hardware tokens come with a serial number which then matches a seed (16, 20 or 24 bytes). otpd uses a tool called "resynctool" that takes the seed and two token otp's (6 digit) to generate state for the token per user. Once resynctool is used the tokens can authenticate against otpd via freeradius.
Now I want to do the same with Android with mOTP with a hotp profile setup. What I did was to create my own 20 byte random seed and supply it to a new profile in your mOTP droid app and then generated two consecutive otp's from that mOTP profile. I then attempt to use resynctool to create state for the Android mOTP on the authentication server. But resynctool fails indicating that it can't find the counter iteration with the seed and two otp's.
Is there something logically wrong with what I am trying to do and how I am doing it? Where is the best place for me to get help with the mOTP app? Does the mOTP app support 16, 20, 24 or how many byte seeds?
Many thanks for your help.
Mike
Hmm, this is odd. When I wrote this application, the HOTP outputs matched the reference implementation here. I will be providing an update to this app that takes care of some issues with TOTP and a general overhaul, but I need to work some things out first. I am not sure why the resynctool is not getting the state properly. Perhaps the seed you enter is the hexadecimal representation of the seed, not the ascii representation which you enter into the app? This website may be able to help (removing : may be necessary). Let me know how it goes, and I will try to get an update out quickly.
You mentioned using an ASCII string for the seed in your app. I was using the hex string. I just retried using ascii in your mOTP app and it works perfectly! This is awesome! Thanks for your help! I honestly don't know how long it might have taken me to think of trying ascii or if I ever would have at all.
One more thing by way of thanks. You have implemented profiles which is fantastic. Since you have done this, it doesn't make a lot of sense to have the number of digits on the main screen. It would be far better if the number of digits desired was set in the profile itself. Then, the only thing showing on the display in normal operation is the profile name and the Generate Key button. I think it extremely unlikely that any OTP system asks for different number of digits once it's set. So the number of digits can be set for each profile and then you're done.
Hey Chris, I like your app. I'd like to make a minor correction, and a suggestion. The minor correction is that hexadecimal is spelled wrong on the "add profile" screen.
The suggestion, is could you possibly add a selection for 30 or 60 seconds, and 6 or 8 digit PIN?
Thanks again.
-Mark
@Mark Abene
Thanks for the suggestions! I will definitely want to fix that spelling error very soon. Adding 30 or 60 seconds and 6 or 8 digits will take some more time, but those are great ideas that I would love to implement.
@Mark Abene
I have finally got around to implementing your corrections. I have fixed the spelling and added the ability to change TOTP's time granularity form 30 to 60 seconds at profile creation time. You could have always changed the PIN length by changing the "Digits" when creating a new profile. I hope this helps you out.
-Chris
Dear Dir, Thx for that nice tool, I'm trying now. I'm using on my server Linux: Apache2-mod-authn-OTP e.g. http://code.google.com/p/mod-authn-otp/wiki/Tokens
May I suggest your to protect by a requested password the access of all the seeds both in "Edit profil" and "View secret" touched menu. Maybe you could create another menu, letting enter password and change password to protet seeds.
Depends on you, but you may let have a common password for all seeds, or individual password seeds protect by Profile.
Thx again for this nice tool.
Another suggestion, as it is made in dongles, and usefull. Can you please show a downscrolling dynamic bars, by 10 seconds steps, that indicates for Time Based OTP, how many seconds away before next code (expiration of actual genrated code). (max Number of bars depends on choosen default 30s or 60s e.g. 3 or 6 bars) So if we are too close from end, we can wait a little. Exemple: At the end, one bar means you are between 9 seconds and 0 seconds before code becomes invalid. Thx again
@Hervé GALMICHE
Thank you for your comments. They are very good comments. As for your first comment, that is a really good idea. Protecting sensitive information via a password prompt is a very good idea. I would not mind implementing if my time was more readily available. I believe the reason I did not initially implement it was that I figured the phone should be the secure point of entry. The phone should be protected by a pin or some other means of security. This would ideally be implemented like how exchange mandates security policies on phones, but this is not the case.
As for your second comment, I believe that it is a nice feature, but it would actually not be trivial to implement. I could put a timer based on the duration of the password, but this would be difficult to actually sync with the display, especially with the phone sleeping periodically. This could be done, but implementing it is definitely a low priority right now.
Thanks for the comments, I really appreciate them. If anyone has any success stories with this application, please feel free to let me know.
-Chris
Hi Chris,
would you plan to implement PIN access for generating OTP key? Now it is not so secure when i can generate OPT key without PIN.
Thanks for info.
Josef
@Josef Svitak
Hi Josef. By PIN access, do you mean that you think you should be required to enter a passcode or PIN to generate a TOTP password? This is not a bad idea and I may find time to do if shortly, but there is a reason that I didn't do it initially. TOTP and other one time password algorithms satisfy the something you have factor of authentication. Any of these types of authentication methods may be stolen or lost. Because of this, something you have type authentication mechanims are almost never utilized by themselves. One time passwords are commonly only one factor in a multifactor authentication system. So even if someone stole your Android device, they wouldn't have sufficient material to falsely authenticate themselves as you. Does this help you?
Post a Comment