Google Authenticator: Understanding TOTP & HOTP

======================================================

In today's increasingly digital world, protecting your online accounts has become more crucial than ever. One effective method of two-factor authentication (2FA) that many users have adopted is Google Authenticenticator's Time-Based Token (TOTP). But what exactly does it do? In this article, we'll delve into the details of TOTP and its sister technology, HMAC-based one-time password (HOTP), to help you better understand how they keep your accounts secure.

What are TOTP & HOTP?

--------------

The acronyms stand for 'Time-Based One-Time Password' and 'HMAC-Based One-Time Password,' respectively. While their names may seem similar at first glance, there's actually a significant difference between them.

### What is TOTP?

TOTP stands for Time-based OTP. It uses the current time as its primary factor to generate an OTP code that remains valid only for a short period (usually 30 seconds). This makes it ideal for scenarios where both parties are relatively synchronized with regards to time, such as when two users at different locations need to access shared resources.

### What is HOTP?

HOTP stands for HMAC-based One-Time Password. Unlike TOTP, which uses the current timestamp as its primary factor to generate an OTP code, HOTs use a counter instead of the actual time stamp. This makes them more suitable for scenarios where precise synchronization between devices isn't necessary or impossible due to network latency issues.

How Does Google Authenticator Work?

-----------------------------

Google's implementation of TOTP is called Google Authenticator (GA). To understand how it works let us break down its core components:

### Seed Generation & Sharing

When you first set up 2FA on a service using GA, the server generates a secret seed that will be used to generate your unique OTP code. This seed should never be shared with anyone else; sharing this information compromises all of your accounts protected by this particular key.

To share or recover access if lost:

1. Open Google Authenticator and navigate to Settings > Account details

2 Click on 'Scan QR Code' next to the account whose recovery codes you want

Alternatively, click on “Enter Recovery Codes” instead of scanning a code if available in your app version.

### Timestep Calculation & Hashing

Once both parties have possession of their respective seed values (or can access them through other means like entering a shared secret), they must now calculate the timestep and apply an appropriate hash function to it. The timestep is simply how many seconds pass since January 1st, 1970 UTC at midnight (00:00). To do this:

* For TOTP, you'll divide your current Unix timestamp by either 30 or 60 depending on whether you want a 30-second window (default) or an hour-long one respectively.

Example:

Current Time = Wed Feb 13 14:47:23 UTC+0530

| |

\___________/

Timestep = floor(1644649243 / 60)

= 27548 (rounded down)

* For HOTP, you'll simply use a counter instead of the actual timestamp.

### Applying Hash Function & Resulting OTP Value

Finally, apply an SHA-256 or similar cryptographic hash function to your timestep value(s) and take either the first six characters for TOTP (or eight for HOTP). This resulting string is what we call our final OTP code.

Totp hotp google authenticator