コンテンツにスキップ

「利用者:T4NeGMp7P4en/sandbox」の版間の差分

履歴の双方向閲覧
← 古い編集新しい編集 →
削除された内容 追加された内容
ビジュアルウィキテキスト
T4NeGMp7P4en (会話) による ID:102484828 の版を取り消し 自己差し戻し
タグ: 取り消し モバイル編集 モバイルウェブ編集 改良版モバイル編集
タグ: モバイル編集 モバイルウェブ編集 改良版モバイル編集
24行目: 24行目:
*: 6–10、デフォルトは6、推奨値は6-8
*: 6–10、デフォルトは6、推奨値は6-8


Both parties compute the HOTP value derived from the secret key ''K'' and the counter ''C''. Then the authenticator checks its locally generated value against the value supplied by the authenticated.
Both parties compute the HOTP value derived from the secret key <math>K</math> and the counter <math>C</math>. Then the authenticator checks its locally generated value against the value supplied by the authenticated.


The authenticator and the authenticated increment the counter ''C'' independently of each other, where the latter may increase ahead of the former, thus a resynchronisation protocol is wise. {{IETF RFC|4226}} does not actually require any such, but does make a recommendation. This simply has the authenticator repeatedly try verification ahead of their counter through a window of size ''s''. The authenticator's counter continues forward of the value at which verification succeeds and requires no actions by the authenticated.
The authenticator and the authenticated increment the counter <math>C</math> independently of each other, where the latter may increase ahead of the former, thus a resynchronisation protocol is wise. {{IETF RFC|4226}} does not actually require any such, but does make a recommendation. This simply has the authenticator repeatedly try verification ahead of their counter through a window of size ''s''. The authenticator's counter continues forward of the value at which verification succeeds and requires no actions by the authenticated.


The recommendation is made that persistent throttling of HOTP value verification take place, to address their relatively small size and thus vulnerability to brute-force attacks. It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.
The recommendation is made that persistent throttling of HOTP value verification take place, to address their relatively small size and thus vulnerability to brute-force attacks. It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.


6-digit codes are commonly provided by proprietary hardware tokens from a number of vendors informing the default value of ''d''. Truncation extracts 31 [[ビット]] or <math display="inline">\log_{10}(2^{31}) \approx 9.3</math> decimal digits, meaning that ''d'' can be at most 10, with the 10th digit adding less variation, taking values of 0, 1, and 2 (i.e., 0.3&nbsp;digits).
6-digit codes are commonly provided by proprietary hardware tokens from a number of vendors informing the default value of <math>d</math>. Truncation extracts 31 [[ビット]] or <math display="inline">\log_{10}(2^{31}) \approx 9.3</math> decimal digits, meaning that <math>d</math> can be at most 10, with the 10th digit adding less variation, taking values of 0, 1, and 2 (i.e., 0.3&nbsp;digits).


After verification, the authenticator can authenticate itself simply by generating the next HOTP value, returning it, and then the authenticated can generate their own HOTP value to verify it. Note that counters are guaranteed to be synchronised at this point in the process.
After verification, the authenticator can authenticate itself simply by generating the next HOTP value, returning it, and then the authenticated can generate their own HOTP value to verify it. Note that counters are guaranteed to be synchronised at this point in the process.


The ''HOTP value'' is the human-readable design output, a ''d''-digit decimal number (without omission of leading 0s):
The ''HOTP value'' is the human-readable design output, a <math>d</math>-digit decimal number (without omission of leading 0s):


: ''HOTP value'' = ''HOTP''(''K'', ''C'') mod 10<sup>''d''</sup>.
: ''HOTP value'' = ''HOTP''(<math>K</math>, <math>C</math>) mod 10<sup><math>d</math></sup>.


That is, the value is the ''d'' least significant base-10 digits of HOTP.
That is, the value is the <math>d</math> least significant base-10 digits of HOTP.


''HOTP'' is a truncation of the [[HMAC]] of the counter ''C'' (under the key ''K'' and hash function ''H''):
''HOTP'' is a truncation of the [[HMAC]] of the counter <math>C</math> (under the key <math>K</math> and hash function <math>H</math>):


: ''HOTP''(''K'', ''C'') = truncate(HMAC{{sub|''H''}}(''K'', ''C'')),
: ''HOTP''(<math>K</math>, <math>C</math>) = truncate(HMAC{{sub|<math>H</math>}}(<math>K</math>, <math>C</math>)),


where the counter ''C'' must be used [[エンディアン|ビッグエンディアン]].
where the counter <math>C</math> must be used [[エンディアン|ビッグエンディアン]].


Truncation first takes the 4 least significant bits of the ''MAC'' and uses them as a byte offset ''i'':
Truncation first takes the 4 least significant bits of the ''MAC'' and uses them as a byte offset ''i'':

2024年11月8日 (金) 04:12時点における版

HMAC-based One-time Password

HMAC-based one-time password (HOTP)は、HMACを利用したワンタイムパスワード (OTP)のアルゴリズムであり、オープン標準として無料公開されている。また、OATHの基礎となっている。

HOTPは、そのアルゴリズムおよびJavaでの実装例を文書化したRFC 4226という形で、2005年12月に公開された。以来、多くの企業で採用されている。

アルゴリズム

HOTPは、一回分の認証試行に限り使用可能な(使い捨ての)パスワードとして、人間にも判読しやすい値を対称的に生成するという方法で本人認証を実現する。使い捨てであるという特性は、生成する度にカウンタの値が変動することに由来する。

Parties intending to use HOTP must establish some parameters; typically these are specified by the authenticator, and either accepted or not by the authenticated:

Both parties compute the HOTP value derived from the secret key and the counter . Then the authenticator checks its locally generated value against the value supplied by the authenticated.

The authenticator and the authenticated increment the counter independently of each other, where the latter may increase ahead of the former, thus a resynchronisation protocol is wise. RFC 4226 does not actually require any such, but does make a recommendation. This simply has the authenticator repeatedly try verification ahead of their counter through a window of size s. The authenticator's counter continues forward of the value at which verification succeeds and requires no actions by the authenticated.

The recommendation is made that persistent throttling of HOTP value verification take place, to address their relatively small size and thus vulnerability to brute-force attacks. It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.

6-digit codes are commonly provided by proprietary hardware tokens from a number of vendors informing the default value of . Truncation extracts 31 ビット or decimal digits, meaning that can be at most 10, with the 10th digit adding less variation, taking values of 0, 1, and 2 (i.e., 0.3 digits).

After verification, the authenticator can authenticate itself simply by generating the next HOTP value, returning it, and then the authenticated can generate their own HOTP value to verify it. Note that counters are guaranteed to be synchronised at this point in the process.

The HOTP value is the human-readable design output, a -digit decimal number (without omission of leading 0s):

HOTP value = HOTP(, ) mod 10.

That is, the value is the least significant base-10 digits of HOTP.

HOTP is a truncation of the HMAC of the counter (under the key and hash function ):

HOTP(, ) = truncate(HMAC(, )),

where the counter must be used ビッグエンディアン.

Truncation first takes the 4 least significant bits of the MAC and uses them as a byte offset i:

truncate(MAC) = extract31(MAC, MAC[(19 × 8 + 4):(19 × 8 + 7)]),

where ":" is used to extract bits from a starting bit number up to and including an ending bit number, where these bit numbers are 0-origin. The use of "19" in the above formula relates to the size of the output from the hash function. With the default of SHA-1, the output is 20 バイト, and so the last byte is byte 19 (0-origin).

That index i is used to select 31 bits from MAC, starting at bit i × 8 + 1:

extract31(MAC, i) = MAC[(i × 8 + 1):(i × 8 + 4 × 8 − 1)].

31 bits are a single bit short of a 4-byte word. Thus the value can be placed inside such a word without using the sign bit (the most significant bit). This is done to definitely avoid doing modular arithmetic on negative numbers, as this has many differing definitions and implementations.[1]

トークン

Both hardware and software tokens are available from various vendors, for some of them see references below. Hardware tokens implementing OATH HOTP tend to be significantly cheaper than their competitors based on proprietary algorithms.[2] As of 2010, OATH HOTP hardware tokens can be purchased for a marginal price.[3] Some products can be used for strong passwords as well as OATH HOTP.[4]

Software tokens are available for (nearly) all major mobile/スマートフォン platforms (J2ME,[5] Android,[6] iPhone,[7] BlackBerry,[8] Maemo,[9] macOS,[10] and Windows Mobile[8]).

業界の反応

Although the early reception from some of the computer press was negative during 2004 and 2005,[11][12][13] after IETF adopted HOTP as RFC 4226 in December 2005, various vendors started to produce HOTP-compatible tokens and/or whole authentication solutions.

According to the article "Road Map: Replacing Passwords with OTP Authentication"[2] on strong authentication, published by Burton Group (a division of ガートナー) in 2010, "ガートナー's expectation is that the hardware OTP form factor will continue to enjoy modest growth while スマートフォン OTPs will grow and become the default hardware platform over time."

参照

脚注

  1. ^ Frank, Hoornaert; David, Naccache; Mihir, Bellare; Ohad, Ranen (2005年12月). HOTP: An HMAC-Based One-Time Password Algorithm. doi:10.17487/RFC4226. https://tools.ietf.org/html/rfc4226#section-5.3. 
  2. ^ a b Diodati, Mark (2010年). “Road Map: Replacing Passwords with OTP Authentication”. Burton Group. 2011年7月21日時点のオリジナルよりアーカイブ。2011年2月10日閲覧。
  3. ^ “Security Authentication Tokens — Entrust”. Entrust (2011年). 2013年4月5日時点のオリジナルよりアーカイブ。2010年3月5日閲覧。
  4. ^ “Password sCrib Tokens — Smart Crib”. Smart Crib (2013年). 2013年3月20日時点のオリジナルよりアーカイブ。2013年10月21日閲覧。
  5. ^ “DS3 Launches OathToken Midlet Application”. Data Security Systems Solutions (2006年2月24日). 2013年12月29日時点のオリジナルよりアーカイブ。2011年2月10日閲覧。
  6. ^ “StrongAuth” (2010年). 2010年5月18日時点のオリジナルよりアーカイブ。2011年2月10日閲覧。
  7. ^ Cobbs, Archie L. (2010年). “OATH Token”. Archie L. Cobbs. 2011年2月10日閲覧。
  8. ^ a b “ActivIdentity Soft Tokens”. ActivIdentity (2010年). 2010年9月17日時点のオリジナルよりアーカイブ。2011年2月10日閲覧。
  9. ^ Whitbeck, Sean (2011年). “OTP Generator for N900”. Sean Whitbeck. 2012年2月11日閲覧。
  10. ^ “SecuriToken”. Feel Good Software (2011年). 2012年4月25日時点のオリジナルよりアーカイブ。2011年11月1日閲覧。
  11. ^ Kearns, Dave (2004年12月6日). “Digging deeper into OATH doesn't look so good”. Network World. 2010年10月7日閲覧。
  12. ^ Willoughby, Mark (2005年3月21日). “No agreement on Oath authentication”. Computerworld. 2012年10月11日時点のオリジナルよりアーカイブ。2010年10月7日閲覧。
  13. ^ Kaliski, Burt (2005年5月19日). “Algorithm agility and OATH”. Computerworld. 2012年10月11日時点のオリジナルよりアーカイブ。2010年10月7日閲覧。

外部リンク

「https://ja.wikipedia.org/w/index.php?title=利用者:T4NeGMp7P4en/sandbox&oldid=102492265」から取得