Multi-Factor Authentication
- Authentication that requires more than one factor to verify identity.
- Combines password (something you know) + second factor (something you have).
| Factor Type |
Example |
| Something you know |
Password, PIN |
| Something you have |
Phone, hardware token, smart card |
| Something you are |
Fingerprint, face recognition |
HOTP (HMAC-Based One-Time Password)
One-Time Password generated using a secret key + counter, based on HMAC:
- Server and user share a secret key
K
- Each time a code is requested:
- Increment counter
C (event based)
- Compute: HOTP =
Truncate(HMAC_SHA1(K, C))
- Returns a 6–8 digit code
- Example:
123456
- User enters code during login
- Server verifies code using same secret + counter
// so server also need to track counter
TOTP (Time-Based One-Time Password)
HOTP variant, where counter = current time / step, usually 30 seconds.