How deeply does Real-World Cryptography cover one-time code?

Explains symmetric-key derivation, HOTP counters, TOTP time values, registration, generation, and constant-time validation.

One-time code

As explained in Real-World Cryptography

A one-time password is an authentication code intended to be accepted for only one authentication attempt or a narrowly defined validity period.

A one-time code replaces a long-term password during authentication. It is derived from a uniformly random symmetric key and additional data, then accepted only once or within a narrow validity period. Reusing it would defeat its purpose: exposure should not grant unlimited account access. section 11.2.3

Two common schemes differ in the extra value combined with the shared key:

HOTP uses a counter, requiring client and server state to remain synchronized. section 11.2.3
TOTP uses the current time and is widely used because it avoids maintaining a shared counter state. section 11.2.3
Mobile authenticator applications and security keys commonly generate these codes. section 11.2.3

TOTP sign-in

During registration, a service shares a symmetric key with an authenticator application, often through a QR code. Later, the application generates a six-digit code; the service independently computes the expected value with HMAC and the current time, then compares the values in constant time. section 11.2.3

How Real-World Cryptography covers it

liveBook manning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersA one-time password is an authentication code that is valid for a single use or a limited period.
liveBook manning.com

Authorization in ActionA one-time password is a temporary authentication code intended to be accepted only once or during a limited validity period.

Compare how 3 books explain one-time code →

Related concepts

password reset flowused by · A password reset flow is a process for replacing an account password, often after verifying control of the associated account.
password authenticationcontrasts with · Password authentication is an authentication method that verifies a claimed identity or access by checking a supplied secret password or passphrase.
multifactor authenticationuses · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
HOTPincludes · HOTP is a one-time-password algorithm that derives authentication codes from a secret key and a counter.
TOTPincludes · TOTP is a one-time-password algorithm that generates short-lived authentication codes from a shared secret and the current time.
possession factorkind of · A possession factor is an authentication factor based on the claimant’s control of a required physical item or device.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.