What does OTP mean?
One-time password (OTP) systems provide a mechanism for logging on to a network or service using a unique password that can only be used once, as the name suggests.
The static password is the most common authentication method and the least secure. If "qwerty" is always your password, it's time to change.
Why is a one-time password safe?
The OTP feature prevents some forms of identity theft by making sure that a captured username/password pair cannot be used a second time.
Typically the user's login name stays the same, and the one-time password changes with each login.
One-time passwords (aka One-time passcodes) are a form of strong authentication, providing much better protection to eBanking, corporate networks, and other systems containing sensitive data.
Authentication answers the question: "Are you indeed Mr or Mrs/en/markets/digital-identity-and-security/banking-payment/digital-banking/passkeys-for-financial-institutions X?"
Today most enterprise networks, e-commerce sites, and online communities require only a username and static password for login and access to personal and sensitive data.
OTP and TOTPvs static password
Although this authentication method is convenient, it is not secure because online identity theft – using phishing, keyboard logging, man-in-the-middle attacks, and other practices – is increasing worldwide.
Robust authentication systems address the limitations of static passwords by incorporating an additional security credential, such as a temporary one-time password (OTP), to protect network access and end-users' digital identities.
This feature adds extra protection and makes it more challenging to access unauthorized information, networks, or online accounts.
Time-based One-Time Password (TOTP) changes after a set period, such as 60 seconds.
In India, the mAadhaar app on your mobile phone allows you to generate a dynamic OTP instead of waiting for a one-time password to arrive. The app's algorithm generates a dynamic OTP or TOTP. The 8-digit code is valid for 30 seconds.
It sounds simple, and it is.
Here is an example of OTP in online payment.
How are one-time passwords created?
One-time passwords can be generated in several ways, each with security, convenience, cost, and accuracy trade-offs.
Grid cards
Simple methods such as transaction number lists and grid cards can provide a set of one-time passwords.
These methods offer low investment costs but are slow, difficult to maintain, easy to replicate and share, and require the users to keep track of where they are in the list of passwords.
Security tokens
A more convenient way for users is to use an OTP token, a hardware device capable of generating one-time passwords.
There's more.
Some of these devices are PIN-protected, offering an additional level of security.
The user enters the one-time password with other identity credentials (typically user name and password), and an authentication server validates the logon request.
Although this is a proven solution for enterprise applications, the deployment cost can make the solution expensive for consumer applications.
Because the token must be using the same method as the server, a separate token is required for each server login, so users need a different token for each Web site or network they use.
Smart cards and OTP
More advanced hardware tokens use microprocessor-based smart cards to calculate one-time passwords.
Smart cards have several advantages for strong authentication, including data storage capacity, processing power, portability, and ease of use.
They are inherently more secure than other OTP tokens because they generate a unique, non-reusable password for each authentication event, store personal data, and do not transmit confidential or private data over the network.
Display payment cards can even integrate an OTP generator for 2-factor authentication.
Public Key Infrastructure for OTP strong authentication
Smart cards can also include strong authentication capabilities such as PKIor Public Key Infrastructure certificates.
When used for PKI applications, the smart card device can provide core PKI services, including encryption, digital signature, and private key generation and storage.
Thales smart cards support OTP strong authentication in both Java™ and Microsoft .NET environments.
Multiple form factors and connectivity options are available so that end-users have the most appropriate device for their network access requirements.
All Thales OTP devices work with the same Strong Authentication Server and are supported with a standard set of administrative tools.
Single-factor authentication (SFA)
Single-factor authentication is the traditional security process that requires a username and password before granting access to the user.
A single compromised password was enough to take down the largest US fuel pipeline.
In May 2021, a raid by the ransomware group Darkside forced the shutdown of Colonial Pipeline's network. This attack, which created shortages, pushed up gas prices and led to a wave of panic-buying, put a spotlight on weak password protection and ransomware's potential to disable critical infrastructure.
Bloomberg (4 June 2021) reported that the company's system was breached through a single leak password to an old VPN account used to access the company's servers remotely. The account did not use multifactor authentication. Hackers breached Colonial's network using just one compromised username and password. According to Bloomberg, the user may have used the same password for different accounts, but it would be hard for investigators to know precisely how it's been obtained.
Two-factor authentication (2FA)
Stronger authentication can also be implemented with two-factor authentication (2FA) or multiple-factor authentication. In these cases, the user provides two (or more) different authentication factors.
Below is another example of 2 factor-authentication in banking.
OTP SMS is a standard second-factor authentication method for banks.
At the ATM, you will need your card (something you have) AND a PIN code (something you know).
In Singapore, Singpass uses Two-Factor Authentication (2FA) and end-to-end encryption of passwords to access the country's eGovernment services securely.
SMS OTP deprecated
The National Institute of Standards and Technology (NIST, US Department of Commerce) deprecated the use of SMS for 2FA as early as 2016.
The reason?
This authentication method shows vulnerabilities that could compromise passwords and codes.
In addition, the European Union Agency for Cybersecurity (ENISA) called for not using SMS-based one-time passwords.
As a result, businesses and public organizations should consider ways to deliver codes other than SMS.
The EuropeanPSD2 regulation requests stronger customer authentication for banks and financial institutions. As a result, OTP SMS is no longer a PSD2-compliant method.
OTP markets and key industry players
The OTP segment is part of a more global two-factor authentication market evaluated at $3,5B in 2018. It willreach $8,9B by 2024, as revealed by a Market Research future study.
The OTP market is estimated at $1,5B in 2018 and will reach $3,2B by 2024.
The major players in the two-factor authentication market include Thales, Fujitsu, Suprema, OneSpan, NEC, Symantec, RSA, IDEMIA, HID, Entrust, and Google name a few.
The hardware OTP token authentication business is a small part of the OTP market.
However, according to Research and Markets, its worldwide size is expected to reach $403m by 2025.
Primary customers are enterprises, banking, finance, insurance and securities, government, healthcare, and gaming.
Beyond OTP: More resources onauthentication
- It'stime for a change(CNN)
- Create a more robust password(Google)
- The password is dying.
- How strong is my password?
- Share a secret link that is available only once(One Time Secret)
- A brief history of encryption(Updated in February 2023)
- German banks move away from SMS OTP (ZD Net - 11 July 2019)
- Learn more aboutbiometric authentication(Thales web dossier)
- Discovermultifactor authentication solutions from Thales
- Behavioural biometrics in banking (for stronger authentication)
- Learn more about silent authentication
- Discover our3-factorauthenticationsmart token
- Passwordless authentication and FIDO passkeys
- Advanced OTP in Banking: VTB24 in Russia
- Future of identification
