One-time password or an OTP is a password that is only valid one time. One-time password can be used to enhance security and support strong authentication. This article will explain the basics of one-time passwords and how they can be implemented.

Today most enterprise networks require only a user name and static password to access personal and sensitive data. This type of single-factor authentication is very convenient, however, it’s not very secure in our modern world. Most people understand that they should use unique passwords for every online account. Yet, 69% of us use the same password anyway.

Moreover, 47% of people use a password that's more than 5 years old and the most commonly used password, is '123456' – used by a staggering 17% of people. What's even worse, an eye-watering 95 Percent of People Share Up To 6 Passwords with their friends.

Even if your end-users are good with passwords (they use a different strong password for every online account and never write them down anywhere) they can still be compromised by keylogging malware or man-in-the-middle attacks. So how do you protect yourself and your company's most valuable assets from poor password hygiene or electronic eavesdropping? One way is to use a ‘one-time password’ - a disposable password that is only valid ‘one time’.

What does one-time password mean?

One-time passwords are examples of passwords that are only valid for one login session or transaction, therefore providing protection against various password-based attacks, specifically password sniffing and replay attacks. An example of a One-time password is a password with a series of numbers or characters that are generated automatically.

For this system to work the password has to change every time it's used, but there also needs to be some sort of synchronisation between the ever-changing password, the computer system or application being used, and the end-user. This synchronization also needs to take place without transmitting any data via insecure methods such as email.

How are one-time passwords synchronized?

One-time passwords can be generated in several ways and each one has trade-offs in term of security, convenience, and cost.

1. Time synchronization

One approach to generating one-time passwords is to use time synchronization. Each user has a personal token (which might look like a small calculator or a keychain) with a display that shows a number that changes occasionally. Inside the personal token is a clock that’s been synchronized with the clock on the proprietary authentication server. The device and the application server both generate new one-time password based on a numeric version of the current time.

Time synchronised passwords don’t always have to be a perfect match and typically there’s a window where older or newer passwords will be accepted. This is done simply because it takes humans a bit of time to read and enter a one-time password, so, for example, it would be unusual for a password to change every second, as the end user would not have enough time to enter the password before it becomes invalid.

The password itself is usually a hash of the current time - e.g. 16.43 becomes 1643, which is then run through a code generator and a mathematical process called a hash function (or hash code) to generate a unique 10-digit code, which is the one-time password.

Time is, therefore, an important part of the password algorithm, since the generation of new passwords is based on the ‘current time’. If the clocks get too far out of step, the token won't generate correct passwords and will need to be reset. To avoid the problem of different time zones a Unix timestamp can be used, which is a coordinated universal time.

2. Lock-step

The second method involves the computer system and the token starting with the same shared number (called a seed). Each time a new password is generated the token device increments its own internal counter, and each time you actually log in, the server also then increments it's counter.

It’s possible to get out of step by generating passwords that aren’t used, resulting in the counter in the token advancing more than the counter on the application server. However, tolerance is usually created so that things can be a little bit out of sync, and the server will (usually) automatically re-synchronize in the event that it becomes out of step.

This OTP technique is called lock-step or counter synchronization, and although proprietary hardware is still required it doesn't suffer from the disadvantage of having to keep clocks in time.

3. Transmission-based OTP

The third approach is completely different. Instead of two devices being independently responsible for their own passwords (which are then compared for validity), passwords are randomly generated by the authentication server. As this password is completely random it’s not possible for a token device to automatically stay in step, therefore the one-time password needs to be actively communicated to the end-user.

These types of disposable passwords are often referred to as "SMS-OTP" as they are most commonly sent by text message, but they can also be generated by an app or handheld electronic device (called a security token) or in some cases they may even be printed out and sent by post. When you want to authenticate, the system sends your password to you and you use the password to log in. One of the huge advantages of this method is that it eliminates the need to provide and maintain proprietary hardware.

How are one-time passwords transmitted?