A One-Time Password System
obsoleted by
- rfc-2289 — A One-Time Password System
Extracted elements (25)
No secret information needs to be stored on any system, including the authenticating server. This design property prevents compromise of server-side credential storage from enabling replay attacks against the protected system.
The Lamport hash-chain construction ensures that an eavesdropper who captures a one-time password cannot generate the next required password, because doing so would require inverting the secure hash function.
The one-time password is 64 bits because this length is believed to be long enough to be secure and short enough to be entered manually, expressible as six short words from a 2048-word dictionary.
The seed is transmitted in clear text so that clients can use the same secret pass-phrase on multiple machines using different seeds, and can safely recycle pass-phrases by changing the seed without ever sending the pass-phrase over the network.
Interoperability requires that all OTP servers and generators use the same standard dictionary (originally from RFC 1760, reproduced in Appendix C). Generators supporting pass-phrases longer than 63 characters risk loss of interchangeability with conforming implementations.
All conforming implementations of both server and generators MUST support MD5. They SHOULD support SHA and MAY also support MD4. The generator and server must use the same algorithm to interoperate.
All conforming server implementations MUST protect against the race attack in which an attacker partially intercepts a one-time password, guesses the remainder, and races the legitimate user to complete authentication.
All OTP generators MUST calculate the two-bit checksum appended to the six-word encoding (parity over pairs of bits in the 64-bit key), and all OTP servers MUST verify this checksum explicitly as part of decoding.
All server implementations MUST accept case-insensitive hexadecimal as well as six-word format. Servers are REQUIRED to ignore all white space in hexadecimal representations; leading zeros must be retained in partitioned representations.
Character string pass-phrases MUST contain at least 10 characters to reduce the risk from exhaustive search or dictionary attacks. All implementations MUST support pass-phrases of at least 63 characters.
Generators producing six-word format MUST present words in upper case with single spaces as separators. All servers MUST accept six-word format without regard to case and white space used as separator.
Implementations MUST provide a means to reinitialize the OTP sequence that does not reveal the user's secret pass-phrase. When the sequence is reinitialized, implementations MUST verify that the seed or the pass-phrase is changed.
Installations SHOULD discourage any operation that sends the secret pass-phrase over a network in clear text, as such practice defeats the purpose of a one-time password system.
Servers SHOULD accept the alternate dictionary encoding described in Appendix B. Words in alternative dictionaries are case sensitive, and generators and servers MUST preserve case in processing these words.
The seed MUST consist of purely alphanumeric characters and MUST be 1 to 16 characters in length. The seed MUST be case insensitive and MUST be internally converted to lower case before processing.
To resolve ambiguity between six-word and hex encodings, all implementations MUST use the following scheme: if a six-word encoded OTP is valid, accept it; otherwise if it can be interpreted as hexadecimal and that decoding is valid, accept it.
The alternate dictionary algorithm requires each word W at position N to satisfy alg(W) % 2048 == N, where alg is the OTP hash algorithm. Words must not overlap the standard dictionary and must not consist solely of letters A–F to prevent ambiguity with hexadecimal encoding.
The OTP system produces a 64-bit one-time password by passing the concatenation of the seed and pass-phrase through the hash function N times (the sequence number). Each successful authentication decrements N by one, yielding a unique, non-invertible sequence.
The server maintains a database containing, for each user, the one-time password from the last successful authentication or the first OTP of a newly initialized sequence, together with the corresponding sequence number.
The six-word encoding uses a 2048-word dictionary at 11 bits per word to represent the 64-bit OTP. Two extra checksum bits complete the 66-bit encoding. The standard dictionary is originally from RFC 1760 and reproduced in Appendix C.
OTP protects only against passive eavesdropping/replay attacks. It does not provide privacy for transmitted data and does not protect against active attacks such as IP spoofing and hijacked TCP connections (per CERT CA-95:01).
The system's security depends entirely on the non-invertability of the secure hash functions used. MD4 is generally believed to be weaker than MD5. A server supporting multiple hash algorithms is only as secure as its weakest supported algorithm.
Authentication state: server stores (sequence_number N, OTP_N). On receipt of a candidate password, the server hashes it once and compares to OTP_N; on match, N is decremented and the new OTP replaces the stored one. When N approaches zero, the user must reinitialize with a new seed or sequence to continue.
The challenge format is 'otp-<algorithm identifier> <sequence integer> <seed>'. Tokens MUST be separated by whitespace and the entire string MUST be terminated with a space or newline. The string 'otp-' MUST be in lower case; algorithm identifiers are case sensitive and currently all lower case.
The hexadecimal representation of the 64-bit OTP is 16 hex digits optionally partitioned by white space (ignored by servers). Leading zeros must be retained in any partitioned form.