{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/one-time-password","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/one-time-password/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/one-time-password/"},"term":{"en":"One-time password (OTP)","da":"Engangskode (OTP)"},"aka":{"en":["OTP","one-time code","SMS code"],"da":["OTP","sms-kode","engangskodeord"]},"domain":["security","cs"],"cluster":"controls","layer":"identity","status":"current","era":1986,"summary":{"en":"A short code that works for a single login and then expires, sent by text message or shown in an app.","da":"En kort kode, der virker til ét enkelt login og derefter udløber, sendt som sms eller vist i en app."},"body":{"formal":{"en":"A code valid for one use or a short time window, worked out by an app or token from a shared secret and the clock or a counter, or sent by SMS - used as the \"something you have\" factor in MFA.","da":"En kode, der gælder til én brug eller et kort tidsrum, beregnet af en app eller et token ud fra en delt hemmelighed og uret eller en tæller, eller sendt som sms - brugt som \"noget man har\"-faktoren i MFA."},"plain":{"en":"Like a ticket that is torn in half at the door - it gets you in once, and a copy is worth nothing afterwards.","da":"Som en billet, der bliver revet over ved indgangen - den lukker én ind én gang, og en kopi er intet værd bagefter."},"inPractice":{"en":"A lawyer at a Danish law firm logs in to the case system from home; after her password she types the six numbers shown in an app on her phone, which change every 30 seconds.","da":"En advokat i et dansk advokatfirma logger ind i sagssystemet hjemmefra; efter adgangskoden taster hun de seks cifre, som en app på telefonen viser, og som skifter hvert 30. sekund."},"whyItMatters":{"en":"A stolen password alone no longer gets anyone in, but a code can still be tricked out of a person on a fake page, so phishing-proof methods are stronger.","da":"En stjålet adgangskode alene er ikke længere nok, men en kode kan stadig lokkes ud af folk på en falsk side, så phishing-sikre metoder er stærkere."}},"deepDive":{"en":"Two open algorithms dominate. HOTP (RFC 4226, 2005) computes HMAC-SHA-1 over an 8-byte counter using a shared secret K, then applies dynamic truncation: the low four bits of the last byte of the 20-byte HMAC select an offset, four bytes from that offset are read as a 31-bit integer, and the result modulo 10^d gives a d-digit code (six by default). TOTP (RFC 6238, 2011) replaces the counter with T = floor((Unix time − T0) / X), with T0 = 0 and a time step X of 30 seconds by default, and permits HMAC-SHA-256 and HMAC-SHA-512 as well as SHA-1. Most authenticator apps still use SHA-1, six digits and 30 seconds, which is safe here because HMAC security does not depend on SHA-1 collision resistance.\n\nVerification needs tolerance. HOTP servers use a look-ahead window to resynchronise when a user has pressed the token without logging in; TOTP servers typically accept one time step on either side to allow for clock skew and network delay, and RFC 6238 recommends allowing no more than one step backward. Both need throttling: a six-digit code has only 10^6 values, so without rate limiting an attacker can guess within a validity window, and NIST SP 800-63B requires verifiers to limit consecutive failed attempts. A verifier must also reject reuse of a code that has already been accepted within its window, otherwise a shoulder-surfed or intercepted code can be replayed.\n\nEnrolment is usually a QR code encoding an otpauth:// URI (a de facto format originating with Google Authenticator, not an IETF standard) containing the Base32-encoded secret, issuer, account and parameters. Because the verifier must compute the same HMAC, it stores the secret in recoverable form rather than as a one-way hash; a breach of the seed database compromises every token, as the 2011 attack on RSA's SecurID seeds illustrated. Older schemes include S/KEY (Lamport's hash chain, RFC 1760) and proprietary hardware tokens.\n\nSMS OTP is a different mechanism: the server generates a random code and sends it out-of-band over the telephone network. It inherits that network's weaknesses - SIM-swap fraud, number porting, SS7 interception and malware reading SMS on the device - which is why NIST classifies PSTN delivery as a restricted authenticator. All OTP variants share a structural limitation: the code is a bearer value typed by a human, not bound to the site's origin, so an adversary-in-the-middle phishing page can relay it within its validity window. OTP therefore raises the cost of credential stuffing and password reuse attacks but is not phishing-resistant in the NIST sense, unlike FIDO2/WebAuthn passkeys.","da":"To åbne algoritmer dominerer. HOTP (RFC 4226, 2005) beregner HMAC-SHA-1 over en 8-byte tæller med en delt hemmelighed K og anvender derefter dynamisk trunkering: de fire laveste bit i den sidste byte af den 20 byte lange HMAC udpeger et offset, fire bytes fra det offset læses som et 31-bit heltal, og resultatet modulo 10^d giver en kode på d cifre (som standard seks). TOTP (RFC 6238, 2011) erstatter tælleren med T = floor((Unix-tid − T0) / X), hvor T0 = 0 og tidsskridtet X som standard er 30 sekunder, og tillader HMAC-SHA-256 og HMAC-SHA-512 ud over SHA-1. De fleste autentifikator-apps bruger stadig SHA-1, seks cifre og 30 sekunder, hvilket er forsvarligt her, fordi HMAC's sikkerhed ikke afhænger af SHA-1's kollisionsresistens.\n\nVerifikationen kræver tolerance. HOTP-servere bruger et look-ahead-vindue til at gensynkronisere, når brugeren har trykket på tokenet uden at logge ind; TOTP-servere accepterer typisk ét tidsskridt til hver side for at tage højde for urforskydning og netværksforsinkelse, og RFC 6238 anbefaler højst ét skridt bagud. Begge kræver begrænsning af forsøg: en sekscifret kode har kun 10^6 værdier, så uden rate limiting kan en angriber gætte inden for et gyldighedsvindue, og NIST SP 800-63B kræver, at verifikatoren begrænser antallet af fejlede forsøg i træk. En verifikator skal også afvise genbrug af en kode, der allerede er accepteret inden for vinduet, ellers kan en aflurt eller opsnappet kode afspilles igen.\n\nTilmelding sker som regel via en QR-kode med en otpauth://-URI (et de facto-format, der stammer fra Google Authenticator, ikke en IETF-standard), som indeholder den Base32-kodede hemmelighed, udsteder, konto og parametre. Fordi verifikatoren skal beregne samme HMAC, gemmer den hemmeligheden i genskabelig form frem for som et envejshash; et brud på seed-databasen kompromitterer alle tokens, som angrebet på RSA's SecurID-seeds i 2011 viste. Ældre ordninger omfatter S/KEY (Lamports hashkæde, RFC 1760) og proprietære hardwaretokens.\n\nSms-engangskoder er en anden mekanisme: serveren genererer en tilfældig kode og sender den out-of-band over telefonnettet. Den arver nettets svagheder - SIM-swap-svindel, nummerflytning, SS7-aflytning og malware, der læser sms'er på enheden - og derfor klassificerer NIST levering via PSTN som en \"restricted\" autentifikator. Alle OTP-varianter deler en strukturel begrænsning: koden er en ihændehaverværdi, som et menneske taster, og den er ikke bundet til sitets origin, så en adversary-in-the-middle-phishingside kan videresende den inden for gyldighedsvinduet. OTP gør derfor credential stuffing og genbrug af adgangskoder dyrere for angriberen, men er ikke phishing-resistent i NIST's forstand, i modsætning til FIDO2/WebAuthn-passkeys."},"edges":[{"type":"requires","to":"cs/authentication","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/authentication-factor","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"cs/passkey","why":{"en":"A one-time code can be typed into a fake site by mistake; a passkey only answers the real site.","da":"En engangskode kan ved en fejl tastes ind på en falsk side; en passkey svarer kun det rigtige site."},"confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/credential-stuffing","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/password","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/two-factor-authentication","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Ordliste (MFA - SMS-kode eller app-godkendelse)","tier":"course-material"},{"title":"RFC 6238 - TOTP, Time-Based One-Time Password Algorithm","tier":"standard"},{"title":"NIST SP 800-63B - Digital Identity Guidelines, Authentication and Lifecycle Management","tier":"standard"}],"draft":true}