HOTP Unveiled: The Surprising Design Choices Behind Two-Factor Authentication

AI-created, human-edited.

In a recent episode of Security Now, hosts Steve Gibson and Leo Laporte dove deep into the fascinating world of two-factor authentication codes, sparked by an intriguing observation from a listener. The discussion revealed surprising insights about how these ubiquitous security codes are generated—and some questionable design choices in their implementation.

The episode began with a listener's observation that two-factor authentication codes seemed to contain more repeated digits than one would expect. This simple observation led to a comprehensive exploration of the TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password) algorithms that generate these codes.

At their core, these authentication codes rely on two key standards:

• TOTP (RFC 6238, 2011): Handles the time-based aspects
• HOTP (RFC 4226, 2005): Generates the actual codes

The process begins with an HMAC (Hash-based Message Authentication Code) using SHA-1, which produces 160 bits of cryptographically secure pseudo-random data. This is where things get interesting—and according to Gibson, where the implementation takes an unexpected turn.

Gibson presented what he considered the mathematically elegant approach to generating six-digit codes: taking the entire 160-bit number and performing successive divisions by 10, using the remainders to generate truly random digits. This method would utilize all available entropy from the SHA-1 hash.

Instead, the standardized HOTP algorithm uses what Gibson somewhat critically termed a "kindergarten design":

1. Takes the last byte of the hash
2. Masks off the upper 4 bits
3. Uses the remaining bits as an offset to select four bytes from the hash
4. Forces the result to be positive by clearing the highest bit
5. Divides by one million to get a six-digit code

Gibson and Laporte identified several issues with this approach:

• It wastes most of the available entropy
• The byte selection process is needlessly complex
• The implementation suggests a fundamental misunderstanding of how cryptographic hashes work

Perhaps the most surprising revelation was that the complex byte selection process serves no cryptographic purpose. As Gibson explained, any four bytes from a cryptographically secure hash would be equally random—the designers could have simply used the first four bytes and achieved the same result with much simpler code.

Despite the implementation's peculiarities, Gibson and Laporte concluded that the system remains secure for its intended purpose. The generated codes are still sufficiently random, and the 30-second rotation provides adequate security. The perceived patterns in the codes that sparked the initial investigation are likely due to apophenia—the human tendency to see patterns where none actually exist.

Key Takeaways:

1. The standardized HOTP implementation is needlessly complex
2. It wastes significant entropy from the SHA-1 hash
3. The implementation suggests possible misunderstandings by the original designers
4. Despite its flaws, the system remains secure for practical purposes
5. Perceived patterns in 2FA codes are likely psychological rather than mathematical

This deep dive into 2FA code generation reveals an important truth about security implementations: they don't need to be perfect to be effective. While the HOTP standard may not be the most elegant solution possible, it achieves its security goals while being simple enough for widespread implementation. Sometimes, as Gibson and Laporte noted, practicality trumps theoretical perfection in real-world security solutions.

The discussion serves as a fascinating case study in how security standards evolve and how even widely-used systems can harbor surprising implementation choices. It also highlights the importance of understanding the underlying mechanisms of our security tools, even if their flaws turn out to be more amusing than concerning.

Subscribe to Security Now for all your cybersecurity news.