OTP - is a password which is valid only for one authentication session. Password validity could be also limited in time. The advantage of One Time Password is inability to
use the same password twice. Hence if password is intercepted somehow it will be useless.
The aim of this post is not to give you all pros and cons of OTP. I'll let my reader dig it on his own :) Instead I want to show you how OTP could be implemented in JavaCard STK applet.
The main problem of OTP for end-users is inability to keep in mind all One Time Passwords therefore we need some additional device to generate it on the fly - JavaCard STK applet.
Let's have a look how we can do it. First of all we will implement 2 menu items for Init key and Get next password as:
/** * Constructor of the applet */ public otp() { // Get the reference of the applet ToolkitRegistry object reg = ToolkitRegistry.getEntry (); menuGetNextPasswd = new byte[] { (byte) 'G', (byte) 'e', (byte) 't', (byte) ' ', (byte) 'n', (byte) 'e', (byte) 'x', (byte) 't', (byte) ' ', (byte) 'p', (byte) 'a', (byte) 's', (byte) 's', (byte) 'w', (byte) 'o', (byte) 'r', (byte) 'd' }; menuInitKey = new byte[] { (byte) 'I', (byte) 'n', (byte) 'i', (byte) 't', (byte) ' ', (byte) 'k', (byte) 'e', (byte) 'y' }; // Define the applet Menu Entry idMenuGetNextPasswd = reg .initMenuEntry (menuGetNextPasswd, (short) 0, (short) menuGetNextPasswd.length, PRO_CMD_SELECT_ITEM, false, (byte) 0, (short) 0); idMenuInitKey = reg .initMenuEntry (menuInitKey, (short) 0, (short) menuInitKey.length, (byte) 0, false, (byte) 0, (short) 0); // during instantiation of the applet key isn't initialized yet isKeyInitialized = false; // fixing key length to 20 bytes key = new byte[KEY_LENGTH]; tmpBuf = new byte[KEY_LENGTH_ASCII]; }
Then we have to implement processToolkit() method to treat menu items selections:
public void processToolkit(byte event) { EnvelopeHandler envHdlr = EnvelopeHandler.getTheHandler (); // Manage the request following the MENU SELECTION event type if (event == EVENT_MENU_SELECTION) { // Get the selected item byte selectedItemId = envHdlr.getItemIdentifier (); // Perform the required service following the menuGetNextPasswd // selected item if (selectedItemId == idMenuGetNextPasswd) { getNextPasswd (); } // Perform the required service following the menuInitKey selected // item if (selectedItemId == idMenuInitKey) { initKey (); } } }
The initKey() method will request initial key which will be used for next password calculation. The method getNextPasswd() could be implemented in the following way:
/** * Manage the menuGetNextPasswd selection */ private void getNextPasswd() { if (isKeyInitialized) { try { hash = MessageDigest.getInstance (MessageDigest.ALG_SHA, true); hash.doFinal (key, (short) 0, (short) key.length , tmpBuf, (short) 0); Util.arrayCopyNonAtomic (tmpBuf, (short) 0, key, (short) 0, (short) key.length); displayHexBuffer (key, (short) key.length); } catch (CryptoException e) { } } else { displayText(msgKeyNotInited); } return; }
After password generation we need to verify it somehow on the server side. Let's implement authentication server simulator. I'll show you only proof-of-concept implementation, a simple GUI application wich requires password and verifies it. It looks like this:
I've used Clojure for it:
(def md (MessageDigest/getInstance "SHA-1")) (defn ascii2hex [ascii-str] (map #(Integer/parseInt % 16) (map #(apply str %) (partition 2 ascii-str)))) (defn bytes2hexStr [bytes] (apply str (map #(.toUpperCase %) (map #(format "%02x" %) (map #(bit-and 0xFF %) (seq bytes)))))) (defn get-next-password [key-str] (. md reset) (bytes2hexStr (seq (. md digest (into-array Byte/TYPE (map #(.byteValue %) (ascii2hex key-str)))))))
The full source code of the applet and authentication server simulator could be found on my GitHub page.
Peace on you! :)
