Businesses have to facilitate sharing of data over the network, while preventing theft or unauthorized access of that data in an increasingly hostile environment. Organizations must be able to establish the identity of the remote entity with a high degree of certainty. The Initiative for Open Authentication (OATH) is developing technology to enable strong authentication of all users on all devices, across all networks, such as its algorithm for one-time passwords.
OATH includes more than 90 companies, including leading device, platform and application companies. Participants work collectively to facilitate standards work and build a reference architecture for open authentication.
The OATH reference architecture document covers client framework, validation framework, client provisioning and a common data model.
One of the group’s first achievements was the development of an open, royalty-free algorithm for one-time passwords. HOTP OATH has promoted the HOTP algorithm for one-time password (OTP) credentials. It uses available building blocks such as Hashed Message Authentication Codekey and Secure Hash Algorithm-1 and generates a series of OTPs based on a secret key shared between the client and server. One of the goals for this algorithm was embedding into existing devices such as USB flash drives and mobile phones, and hence this is an event-based algorithm.
OATH reference architecture acknowledges that one size does not fit all, and supports additional authentication methods (such as challenge-response, time-based OTP, certificates) which may or may not be OATH-defined. Developers can pick and choose the OATH pieces they want to implement.
To generate an OTP value, the remote entity needs a client that implements OATH HOTP. One can implement an OTP client leveraging the source code that is provided in RFC 4226. Alternatively, there are existing devices available from several OATH vendors in various form-factors – stand-alone OTP tokens, smart cards, USB flash drives, SIM cards and mobile phones.
To authenticate, the networked entity needs to send the OTP to the application in addition to a username and password. This enables two-factor authentication (what you know – password, and what you have – HOTP client). Because this OTP is typically a six-digit value, it can be sent to the application using existing methods and protocols.
Lastly, the application needs to verify the username and password sent by the remote entity against a user store (typically a Lightweight Directory Access Protocol directory) and validate the OTP value. The OATH reference architecture espouses the use of RADIUS that is a widely implemented protocol in network systems for validating the OTP.
Once the application has ascertained the identity of the user with a high degree of certainty (using two factors), the application can provide the remote entity access to the requested resource while efficiently managing the risk of unauthorized access to or theft of data.
An OTP-based approach requires that the user generate and use a different OTP each time. This makes it impossible for passwords to be sniffed and stolen and then re-used at a later time.
Hoffmeier is technical director for SPYRUS and Grajek is president of Multi-Factor Authentication. They can be reached at jhoffmeier@spyrus.com and ggrajek@multifa.com, respectively.
