mainOATH Toolkit - Support: sr #108937, Improve security by disallowing...

 
 

sr #108937: Improve security by disallowing TOTP code reuse

Submitter:  None
Submitted:  Thu 10 Dec 2015 06:39:38 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 10 Dec 2015 06:39:38 PM UTC, original submission:  

There is nothing in the HOTP standard that prevents TOTP codes to be reused. This allows attackers to perform synchronous attack when able to read the code (think MitM, keylogger...) and, simply, to log in the same time as the user do. This is blocked by counter-based HOTP but these have other issues.

An interesting security feature of the google-authenticator PAM module is to prevent a code from being used more than once. See https://github.com/google/google-authenticator/blob/master/libpam/pam_google_authenticator.c#L1008 for implementation. This significantly increase security in the specific attack scenario described above.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code