liveBook · Manning

TOTP

As explained in Real-World Cryptography

TOTP is a one-time-password algorithm that derives time-varying authentication codes from a shared secret and the current time.

TOTP replaces a reusable, low-entropy password with a short code derived from a shared random symmetric key and the current time. The code changes over time, limiting reuse. section 11.2.3

A typical TOTP login follows these steps:

  • During registration, the service communicates a symmetric key to the user, often through a QR code. section 11.2.3
  • The user’s authenticator computes HMAC using the key and current time, then displays a truncated, human-readable code. section 11.2.3
  • The user submits the code; the service recomputes it from the associated key and compares both values in constant time. section 11.2.3

Authenticator-app login

A user imports a service-specific key into an authenticator application, reads its changing six-digit code, and enters that code on the service. The service independently derives the expected value.

How Real-World Cryptography covers it

How deep it goes
Explains registration, HMAC-based generation, submission, server recomputation, and constant-time comparison without implementation-level detail.
Examples
Uses QR-code registration, authenticator applications, six-digit codes, and a service-side verification sequence.
What it assumes
Teaches shared-key OTP generation and HMAC-based verification while assuming a registering service and authenticator application.
What you can do after
Apply it via an authenticator application to generate and submit time-based authentication codes.
How it connects
Connects TOTP to one-time passwords, symmetric keys, HMAC, and HOTP.
Cover of Real-World Cryptography
liveBookmanning.com
Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.