Hash Chain One-Time Password System Replay Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password systems face challenges in security, including complexity in bookkeeping and susceptibility to hacking and replay attacks, as well as the inconvenience of requiring additional authentication steps and reliance on insecure channels for password delivery.
Innovation Solution
A cryptographic hash chain-based password generation system using a one-way programmable storage device, where a seed is hashed multiple times to create a series of one-time passwords, with the public hash value stored in a permanent, one-time programmable hardware device, preventing password reuse and reducing the need for secret value storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password systems are used, then password management is simple, but security is compromised due to predictability and replay attacks
Solution Approach 1:
The password is segmented into multiple one-time passwords arranged in a hash chain sequence. Each OTP can only be used once and validates the next OTP in the sequence, preventing replay attacks while maintaining manageable complexity through automated verification.
Solution Approach 2:
The system performs preliminary actions by pre-generating a hash chain of OTPs and storing only the final hash value. This eliminates the need for complex bookkeeping during authentication, as the system only needs to verify the chain integrity from the stored hash rather than managing multiple secret values.
2Reliability
If one-time passwords are implemented to prevent replay attacks, then security against replay attacks improves, but bookkeeping complexity increases due to storing hash chain values and seed values
Solution Approach 1:
The system extracts and stores only the essential final hash value of the OTP chain, removing the need to store intermediate hash chain values and multiple seed values. This extraction approach maintains replay attack resistance while dramatically reducing bookkeeping complexity to storing a single hash value.
Solution Approach 2:
Instead of storing complex secret data structures, the system creates a simplified copy - just the final hash value of the OTP chain. This copy contains all necessary verification information without the complexity of the original secret values, enabling secure verification with minimal storage requirements.
3Reliability
If additional authentication steps like 2FA are required, then security against password theft improves, but user convenience deteriorates due to frequent additional actions
Solution Approach 1:
The OTP system enables continuous authentication without interruption by automatically generating and verifying password sequences. Users experience a seamless login process where the OTP verification is integrated into the standard authentication flow, eliminating the need for separate 2FA steps while maintaining strong security.
4Reliability
If hardware-based OTP generators are used, then security against hacking improves, but device portability and ease of use worsen due to the need to protect and carry the hardware device
Solution Approach 1:
The system replaces the mechanical hardware OTP generator with a software-based hash chain verification system. This substitution eliminates the need for physical hardware devices that users must carry and protect, while maintaining strong security through cryptographic verification of the OTP sequence.
Data Source
AI summary
An administrative system generates a sequence of passwords by iterative evaluation of a hash function, initiated from a private key value and continuing to a final, public key value. A current token is created that includes a current one of the passwords. A protected device tests the validity of the current password by inputting it to a hash function sub-chain. The current password is considered valid if, after hashing the current password n+1 times, where n corresponds to the number of tokens previously received, the result is a revealed value, such as a previously verified password of the public key value. At least one unit of a one-time programmable hardware device, such as processor fuses or anti-fuses, is then physically and permanently altered, thereby incrementing a count entry indicating the number of tokens received. The protected device performs a desired action only if the current password is verified.