One-Time Password (OTP)

One-Time Password (OTP) is a unique password that is valid for only one login session or transaction, on a computer system or other digital device. It is used in a multifactor authentication (MFA/2FA) process to secure access to data. A one-time password is a password that has two fundamental properties : it expires quickly, and it can’t be reused. You will frequently hear the abbreviation OTP as well as the terms “OTP key” and “OTP code”. OTPs avoid a number of shortcomings that are associated with traditional (static) password-based authentication; a number of implementations also incorporate two factor authentication by ensuring that the one-time password requires access to something a person has (such as a small keyring fob device with the OTP calculator built into it, or a smartcard, USB token or specific cellphone) as well as something a person knows (such as a PIN).

The OTP generator

The OTP generator will provide the user with a unique password generated on:

• something that the user has (an authentication token or smart card)
• a Time-based One-time Password (TOTP) – which is an OTP where the moving factor is time-based
• a HMAC-based One-time Password algorithm (HOTP) – which is an event-based OTP where the moving factor is counter-based rather then time-based

Depending on the MFA solution that is at the origin of the OTP, the OTP generator can also include something that the user knows (e.g a PIN code). This is why it is important to carefully look if your MFA solution is based on multiple or only 1 factor.