]> Orange S.A.

2 avenue Pierre Marzin Lannion 22300 FR regis.corbel@orange.com http://www.orange.com

General Internet Engineering Task Force OTP One-time password This document aims to submit a few updates to RFC 2289 , which describes a One-Time Password (OTP) System: an application programming interface to the new Secure Hash Algorithms (SHA256, SHA384, and SHA512), an algorithm for folding hashes to 64 bits, using alternate dictionaries, and automatic renewal of authentication parameters will be described.

Introduction When was published in 1998, and became a Standards Track specification in 2000, it described a powerful One-Time Password system. Many things have changed since that time, notably the way hashes are computed: one distinct interface for each hash algorithm yesterday, only one today. We describe here that unique interface. As a consequence, folding hashes to 64 bits (the length of an OTP) requires a different technique, which is also described. Finally, we suggest a technique for automatically renewing authentication parameters between a user and an OTP authentication server. Understanding is a requirement.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Interfaces to Secure Hash Algorithms In 1998, only three secure hash algorithms were commonly used: MD4 , MD5 , and SHA1 . As the security of those algorithms became insufficient, three new secure hash algorithms appeared: SHA256, SHA384, and SHA512 . MD4 is not used anymore. A common interface has been defined by OpenSSL for those five hash algorithms, in C :

Folding hashes to 64 bits The lengths of the hashes produced by MD5, SHA1, SHA256, SHA384, and SHA512 are, respectively, 128, 160, 256, 384, and 512 bits. Since the length of an OTP is 64 bits, it is necessary to fold the hashes. The technique in C for folding MD5 hashes to 64 bits is taken as is from (Appendix A): The technique for folding SHA hashes to 64 bits is a generalization of the one presented in for SHA1. It is designed to be compiled and to run on a 64-bit, Little Endian platform. This algorithm is written in C . > 24) & 0xFF); d2[j+1] = (unsigned char)((ld[i] >> 16) & 0xFF); d2[j+2] = (unsigned char)((ld[i] >> 8) & 0xFF); d2[j+3] = (unsigned char)((ld[i] ) & 0xFF); } } ]]> We now have the tools for producing 64-bits OTP from hashes computed by any of the five algorithms. Appendix A gives a series of inputs and correct outputs to check the behavior of an implementation of an OTP generator. gives such information for MD5 and SHA1, while Appendix A here gives the information for the same inputs hashed by SHA256, SHA384, and SHA512 hash algorithms. The conversion of a 64-bit OTP to a set of six words taken from the Standard Dictionary is based upon the same process (compute a 2-bit checksum from the 64-bit OTP, stick those two bits at the end of the OTP thus producing a 66-bit value; this value is then splitted into six slices of 11 bits that allow to address six different words in a 2048-word dictionary).

Holes in Alternate Dictionaries specifies a 2048 English word dictionary (Appendix D) that can be used by OTP generators for converting a raw OTP expressed in hexadecimal into a set of six different words taken from that dictionary. This feature is designed to ease authentication by human users. also specifies a way to use Alternate Dictionaries, that is dictionaries made of 2048 words taken from a language different than English, no word appearing in more than one dictionary. As stated in Appendix B: "An alternative dictionary of 2048 words may be created such that each word W and position of the word in the dictionary N obey the relationship: alg( W ) % 2048 == N where alg is the hash algorithm used (e.g. MD4, MD5, SHA1). In addition, no words in the standard dictionary may be chosen." Let's consider the Standard Dictionary and the Alternate Dictionary defined in this document (Appendix B), made of 2048 French words, and let's apply the above algorithm to both lists of words, using the five hash algorithms. The results can be found in this document (Appendix C below). For both lists, the collision rate varies roughly from 35% to 37%. This means that on 10 words taken from one of the lists, almost 4 of them share at least two equal (alg(W) % 2048) values. Concretely, every word W of a n-uplet that share the same (alg(W) % 2048) value will be written in the same slot of the 2048-word alternate dictionary, the last word of the n-uplet taking over the first ones. Finally, this technique leaves (n-1) empty slots or "holes" in the final alternate dictionary. This MAY lead to a security weakness if an attacker gets to know the alternate dictionary computed, as shown above, from an initial list of 2048 words (none of them appears in the Standard Dictionary). The alternate dictionary is reduced by roughly 35% in size, eventually easing the task of guessing one or more words that will appear in the next OTP.

Automatic renewal of authentication parameters By design, OTP's cannot be used forever by the same user: when the sequence number, decreased at each successful authentication, reaches zero, the user can't authenticate anymore. A renewal of the user's parameters MUST occur, by providing the server with a new seed, a new sequence number, and the first matching OTP resulting from these new parameters. A different hash algorithm name MAY also be transmitted to the server. The renewal MAY be done by hand, but it is much more efficient to use an automatic mechanism, that is, that does not require a human hand. This would be particularly useful in the field of the Internet of Objects (IoT), for example. Since the channel between a client and a server is supposed unencrypted, the user cannot transmit his new authentication parameters in clear text. The user MUST encrypt them, by using an algorithm both parties have agreed on when the user's account has been created and provisioned in the server. Obviously, the key used to encrypt the new authentication parameters cannot be the current OTP. So we say that, when the sequence number reaches the value 2, the user computes (normally) the OTP matching this sequence number, and computes also the following OTP, that is the OTP that matches the sequence number 1. That last OTP is then used to encrypt the new authentication parameters, which are thansmitted by the user to the server along with the OTP for sequence number 2. The new parameters MAY be encoded in Base 64 before being transmitted. The user and the server can now renew the authentication parameters, thus initiating a new authentication cycle.

IANA Considerations This document does not create a new registry nor does it register any values in existing registries, and no IANA action is required.

Security Considerations This document is entirely about security. Note that the technique described above allows the user to update his authent parameters anytime, whatever the value of the sequence (superior or equal to 2). It is then possible to design the user client program so that it requests a renewal of its authentication parameters on a regular basis (every hour, every twelve hours,...). The client program can also choose a random number between 2 and the current sequence number, and require a renewal when the sequence number reaches the random number. These techniques would constitute a good protection against race attacks, because they prevent an attacker from accumulating data on the sequences of OTP's he may see.

References Normative References ISO/IEC OpenSSL Software Foundation Inc Informative References NIST

OTP Verification Examples This appendix provides a series of inputs and correct outputs for all three of the new OTP cryptographic hashes, specifically SHA256, SHA384, and SHA512. This document is intended to be used by developers for interoperability checks when creating generators or servers. Output is provided in both hexadecimal notation and the six-word encoding with the Standard Dictionary.

SHA256 ENCODINGS

SHA384 ENCODINGS

SHA512 ENCODINGS

French Alternate Dictionary This dictionary is made up of 2048 French words. None of these words appears in the Standard Dictionary, and none of these words are composed solely of A to F letters (thus avoiding confusion with hexadecimal numbers). This French dictionary MAY be used as an alternate dictionary by a user, although 35% of its words share at least two equal (alg(W)%2048) values (see Appendix C below). But, once again, this list can be used straightforward as an alternate dictionary because, when receiving a set of six words from this list computed by the user willing to authenticate, the server just computes (alg(W)%2048) for each of the six words. It doesn't care about the number of words in the alternate dictionary that generate the same (alg(W)%2048) value, nor does it need to know the alternate dictionary at all (as stated in ). The syntax of the dictionary is that of the C language .

Statistical analysis of English and French dictionaries For a given dictionary (English or EN, French or FR), and a given hash algorithm (MD5, SHA1, SHA256, SHA384, or SHA512), this table shows the number (and ratio on 2048 words) of collisions - that is, the number of words that share at least two equal (alg(word) % 2048) values. The EN dictionary is the standard, while the FR dictionary is made of 2048 French different words shown in Appendix B above. None of these words appears in the English standard dictionary.

lang/alg	MD5	SHA1	SHA256	SHA384	SHA512
FR	759 37,0%	766 37,4%	757 37,0%	763 37,3%	764 37,3%
EN	727 35,5%	722 35,3%	730 35,6%	762 37,2%	755 36,9%

These figures show that collision rate varies from 35,3% to 37,4%, which can be considered very high, whatever the dictionary, word distribution, and hash algorithm. They mean that, among 10 words randomly chosen in a source dictionary, almost 4 of them share 1 slot in the final (computed) alternate dictionary.