Nejste přihlášen/a.
ano tu stránku jsem četl a na základě toho se právě ptám. Píše se tam jenom něco jako ... complements event-based method HOTP, přiečemž nevím (i v češtině), jestli to chápat jako přívlastek přímý nebo nepřímý)
Přičemž stránka HOTP event slovo neobsahuje (kromě neobsahového meta infoboxu)
Trochu mi začíná svítat. Takže se to dělí na time,event, CH-R, biometric a location (přičemž poslední 2 si neumím představit - jak naroubovat biometriku na OTP)
Ale potom tedy o jaké jde eventy, když se to jmenuje event-based? Pokud vezmu time-based, tak předpokládám, že jde o jen o to, že server chce zpět poslat (někam zadat kód) který self-obsahuje informaci (nebo její hash) v jakém časovém intevalu platí a uživatel ho zadá v nějaký čas a to se vůči sobě srovná.
Jak se tyhle 3 liší? Nebo co je klíčová vlastnost každé? Přípaně daj se kombinovat, překrývají se?
Ptal jsem se AI, ale stejně mám z toho dojem, že i ty ostatní jsou přece event-based v důsledku . Nebo je to špatná úvaha?
Dá se TOTP použít při pokusu o přihlášení? Jak bude vypadat postup a algoritmus obou stran při TOTP a EOTP
1. Time-Based OTP (TOTP)
Definition: TOTP generates a one-time password that is valid for a short period, typically 30 seconds.
Mechanism: It uses the current time as an input along with a shared secret key. The algorithm (usually HMAC-SHA1) combines these inputs to produce a unique OTP.
Use Case: Commonly used in two-factor authentication (2FA) applications like Google Authenticator or Authy.
Advantages:
Automatically expires, reducing the risk of replay attacks.
Easy to implement and use with time synchronization.
2. Challenge-Response OTP
Definition: This method generates an OTP based on a challenge (a random number or string) provided by the server.
Mechanism: The server sends a challenge to the user, who then combines it with a shared secret key to generate a response (the OTP). The server performs the same calculation to verify the response.
Use Case: Often used in secure transactions or systems where the server needs to verify the users identity dynamically.
Advantages:
The OTP is unique for each session, making it more secure against replay attacks.
The challenge can be different for each authentication attempt, adding an extra layer of security.
3. Event-Based OTP
Definition: Event-based OTPs are generated based on specific events or actions rather than time or challenges.
Mechanism: The OTP is generated when a specific event occurs, such as a login attempt, a transaction, or a request for access. The event triggers the generation of a unique OTP.
Use Case: Used in scenarios where actions need to be authenticated, such as online banking transactions or accessing sensitive information.
Advantages:
Tailored to specific actions, providing context-aware security.
Can be more user-friendly as it ties the OTP generation to user actions.
Summary
TOTP is time-sensitive and expires quickly, making it suitable for regular logins.
Challenge-Response OTP relies on a server-provided challenge, enhancing security for dynamic sessions.
Ta AI konečně už začíná být zajímavá:
, all OTP types can be considered event-based because they are triggered by specific actions or conditions. However, the distinction lies in how and when the OTP is generated and used. Here’s a clarification:
Commonality
Event-Driven Nature: All three types of OTPs are indeed generated in response to an event, whether that event is a time interval elapsing, a challenge being issued, or a specific user action (like a login attempt).
Distinctions
Time-Based OTP (TOTP):
Event: The event is the passage of time (e.g., every 30 seconds).
Nature: It is predictable and automatically generated based on the current time, regardless of user actions.
Challenge-Response OTP:
Event: The event is the server issuing a challenge.
Nature: It is reactive, requiring user input to generate the OTP based on the challenge provided by the server.
Event-Based OTP:
Event: The event is a specific user action (e.g., initiating a transaction).
Nature: It is context-specific and directly tied to user behavior, making it more dynamic and tailored to the situation.
Conclusion
While all OTP types can be seen as event-based in a general sense, the key differences lie in the nature of the triggering events and the context in which the OTPs are generated. This distinction helps in understanding their specific use cases and security implications.
Event-Based OTP is generated based on specific user actions, providing context-specific security.
Each type of OTP h
Neneseme odpovědnost za správnost informací a za škodu vzniklou jejich využitím. Jednotlivé odpovědi vyjadřují názory jejich autorů a nemusí se shodovat s názorem provozovatele poradny Poradte.cz.
Používáním poradny vyjadřujete souhlas s personifikovanou reklamou, která pomáhá financovat tento server, děkujeme.