Two factor authentication using time base key generator on smartphones

Question

I recently enabled two factor authentication for my Google account. One of the ways of getting the second factor (the key that I have) is to install an Android app on my phone that displays a key for a short duration of time.

What does it take to create a web server solution paired with a smartphone solution?

I am using Windows and .NET on the server side and would be interested in both Android and iPhone apps. Are there existing libraries out there or do I need to start from scratch? Where is some starting documentation and explanations of the techniques used?

Answer 1

This blog post, Using Google Authenticator For Your Website, talks about using google authenticator in your own website.

The Google code provides a command line program that can generate secret keys as well as a PAM module, but it turns out to be very little code to authenticate a TOTP, thereby providing two-factor authentication to your website very easily.

Otherwise take a look at OATH which is an open OTP solution, there are a number of libraries and hardware solutions supporting this technology.

• Yubikey
• OATH based OTP generation

"How do I generate One time passwords (OTP / HOTP)?" might provide some insight as well.

I've also provided a client-only library for the yubikey on bitbucket. The library implements the client-side api for the hardware yubikey.

Answer 2

Look up cryptographic hash functions. The more popular ones, like SHA-1, should have libraries in almost every language. For example, android has the java.security.MessageDigest class. You would hash the current date and time down to the minute, together with a long string unique to the individual, then modify the output somehow to make it reasonable to type into a login dialog.