Q37: How does Time-based One-Time Password (TOTP, RFC 6238) MFA operate internally?
TOTP MFA generates short numeric passcodes synchronized between client apps (Google Authenticator) and servers without network transmission of shared keys.
Internal Mechanics:
- Shared Secret Setup: Server generates a random Base32 secret string, stores it, and shares it via QR code with the client.
- Time Counter: Both parties compute
T = floor(current_unix_timestamp / 30)(30-second window buckets). - HMAC Calculation: Compute
HMAC-SHA1(shared_secret, T). - Dynamic Truncation: Extract a 6-digit integer from the resulting 20-byte HMAC hash.
- Verification succeeds if the user-entered 6-digit code matches the server calculation for current or adjacent time windows.
Key Takeaways
- TOTP uses HMAC hashing over a shared secret key and 30-second time window buckets.
- Servers must check adjacent time windows ($ \pm 1$ bucket) to handle client clock skew.