RFC 2243

OTP Extended Responses

📅 published November 1997, from ietf

OTP Extended Responses 🎀

Okay bestie, here's RFC 2243, the one by C. Metz from The Inner Net. It's a Standards Track doc, dated November 1997, and it's all about OTP Extended Responses 🦋. It doesn't obsolete or update anything, since the header has no Obsoletes or Updates line. Also, quick heads up: this is part 1 of 2 🫶

Status of This Memo ✨

This doc is an Internet standards track protocol spec for the Internet community, and it's asking for discussion and suggestions for improvements 💅 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸

Copyright (C) The Internet Society (1997). All Rights Reserved.

Abstract 🌈

So this doc describes a type of response to an OTP [RFC 1938] challenge that openly says how the response is encoded 🔥 It also gives the codings for the two mandatory OTP data formats that use this new response type ✨

There's a second thing too: a response that lets an OTP generator ask a server to re-initialize a sequence and change parameters like the secret pass phrase 👑

1. Conventions, Terms, and Notation 💖

This doc spells out the data formats and software behaviors you need to use OTP extended responses 🧚 The formats are described three ways: with an ad-hoc UNIX manual page style syntax, with augmented BNF from sections two and three of RFC 822, and with examples. If any of those descriptions clash, the augmented BNF wins 💅 The software behaviors are explained in words, and the specific compliance requirements are listed using the requirements terminology from RFC 2119, where the words MUST, SHOULD, and MAY are defined 🎀

2. Extended Challenges and Extended Responses 🦋

Okay so this section builds on RFC 1938, and it assumes you've already read that one and get what it says 🙈

An extended challenge is one line of printable text. It ends with either a new line sequence that fits the context (like ASCII CR followed by ASCII LF) or a whitespace character 🌸 It has a standard OTP challenge, a whitespace character, and a list that generators use to figure out which extended responses a server supports ✨

An extended response is one line of printable text that ends with a new line sequence that fits the context 💜 It has two or more tokens separated by a single colon (:) character. The first token is a type specifier that says what format the rest of the response is in 🔥 The tokens after it are the argument data for the OTP extended response. At least one token of data MUST be present 👑

2.1. Syntax 🧚

In UNIX manual page like syntax, the general form of an extended challenge could look like this:

<standard OTP challenge> ext[,<extension set id>[, ...]]

And the general form of an extended response could look like this:

<type-specifier>:<arg1>[:<arg2>[:...]]

In augmented BNF syntax, the general form of an extended challenge and an extended response is:

extended-challenge = otp-challenge 1*LWSP-char capability-list
                     (NL / *LWSP-char)
otp-challenge     = <a standard OTP challenge>
capability-list   = "ext" *("," extension-set-id)
extension-set-id  = *<any CHAR except LWSP, CTLs, or ",">
extended-response = type 1*(":" argument) NL
type              = token
argument          = token
token             = 1*<any CHAR except ":" and CTLs>
NL                = <new line sequence appropriate for the context
                     in which OTP is being used>

Here's an example of an extended challenge that says the server supports OTP extended responses, plus a mythical response set called "foo" 🌈

otp-md5 123 mi1234 ext,foo

And here's an example of an extended response using a mythical type named "foo" 🍓

foo:some data:some more data:12345

2.2. Requirements 💅

A server that's compliant with this spec:

  1. MUST be able to receive and parse the general form of an extended response
  2. MUST be able to receive, parse, and correctly process all extended responses specified in this document
  3. MUST process the type field in a case-insensitive manner
  4. MUST reject any authentication attempt using an extended response if it does not support that type of response
  5. SHOULD provide an appropriate indication to the generator if the response was rejected because of (4)
  6. MUST limit the length of the input reasonably
  7. MUST accept otherwise arbitrary amounts of whitespace wherever a response allows it
  8. MUST be able to receive and correctly process standard OTP responses

A generator that's compliant with this spec:

  1. MUST be able to generate standard OTP responses
  2. MUST use standard responses unless an extended challenge has been received for the particular server AND seed
  3. MUST generate the type field in lower case
  4. MUST NOT send a response type for which the server has not indicated support through an extended challenge

Okay, listen up about the x- stuff 🫶 Extension set identifiers and extension type identifiers that start with the prefix "x-" are reserved for private use among implementations that have agreed to use them. Implementations that don't recognise a particular "x-" extension MUST ignore that extension. That means all "x-" extensions will likely be non-interoperable with other extensions. Be careful about a server talking to a generator implementation that does recognize a given "x-" extension but uses it for a different purpose 😭 All of the rest of the extension namespace is reserved to IANA, which will only officially assign an extension into that namespace after the IESG approves the assignment. During the lifetime of the OTP WG, it is recommended that the IESG consult with the OTP WG before approving such an assignment ✨

3. The "hex" and "word" Responses 🦋

Here's a super rare situation: a standard OTP response could be a valid coding in both the hexadecimal and six-word formats 🙈 An example is the response "ABE ACE ADA ADD BAD A." The OTP specification's fix for this is that compliant servers MUST attempt to parse and verify a standard response in both hexadecimal and six-word formats, and must consider the authentication successful if either one succeeds 🔥

Extended responses can fix this way more easily 💖 The "hex" response and the "word" response are two response types that encode an OTP in an extended response that spells out the encoding. They start with a type label of "hex" for a hexadecimal OTP and "word" for a six-word coded OTP 🌸 Each one has one argument field that holds a standard OTP response in the format it names ✨

3.1. Syntax 🧚

In UNIX manual page like syntax, the format of these responses could look like this:

hex:<hexadecimal number>
word:<six dictionary words>

In augmented BNF syntax, using the definitions from before, the syntax of these responses is:

hex-response  = "hex:" hex-64bit NL
hex-64bit     = 16(hex-char *LWSP-char)
hex-char      = ("A" / "B" / "C" / "D" / "E" / "F" /
                 "a" / "b" / "c" / "d" / "e" / "f" /
                 "0" / "1" / "2" / "3" / "4" / "5" /
                 "6" / "7" / "8" / "9")

word-response = "word:" word-64bit NL
word-64bit    = 6(otp-word 1*LWSP-char)
otp-word      = <any valid word in the standard OTP coding
                 dictionary>

Examples of these responses are:

hex:8720 33d4 6202 9172
word:VAST SAUL TAKE SODA SUCH BOLT

3.2. Requirements 💅

A server that's compliant with this spec:

  1. MUST process all arguments in a case-insensitive manner

A generator that's compliant with this spec:

  1. SHOULD generate otp-word tokens in upper case with single spaces separating them
  2. SHOULD generate hexadecimal numbers using only lower case for letters

4.3. Requirements 💅

Okay, bestie, here are the rules. A server that follows this spec:

  1. SHOULD NOT let a user use the same value for their seed and secret pass phrase. Like, pick two different things, it's giving security 🔐
  2. MUST disable all OTP access to any principal whose sequence number would be less than one. No sequence number below one, no OTP access 🚫
  3. MUST decrement the sequence number if a reinitialization response includes a valid current-OTP, but the server is unable to successfully process the new-params or new-OTP for any reason. The number goes back down so nothing gets stuck in a weird half-updated state 🫶

A generator that follows this spec:

  1. SHOULD NOT let a user use the same value for their seed and secret pass phrase. Same vibe as the server side, pick different things 💖
  2. MUST take specific steps to prevent infinite loops of re-initialization attempts in case of failure. Nobody wants a loop that just keeps going forever 🌀
  3. SHOULD give the user some indication that the re-initialization is happening ✨
  4. SHOULD NOT do a re-initialization without the user's permission, either for that specific instance or as a configuration option. Ask first, always 🎀
  5. SHOULD NOT retry a failed re-initialization without a user's permission. Again, ask first, bestie 🙈
  6. SHOULD warn the user if the sequence number falls below ten. Early warning is the iconic move 🔥
  7. MUST refuse to generate OTPs with a sequence number below one. Zero is not it 💀

5. Security Considerations 🔐

All of the security considerations for the OTP system also apply to the OTP system with extended responses. Everything from the regular OTP system carries over, so don't skip that part 📚

These extended responses, like OTP itself, do not protect the user against active attacks. For that you need the IPsec Authentication Header (RFC-1826) (or another technique with at least as much strength as IPsec AH), and that SHOULD be used to protect against such attacks. Not optional energy here 🛡️

The consequences of a successful active attack on the re-initialization response may be more severe than simply hijacking a single session. An attacker could substitute his own response for that of a legitimate user. The attacker may then be able to use the OTP system to authenticate himself as the user at will (at least until detected). This is the scariest plot twist in the whole doc 😭

Failure to implement server requirement 3 in section 4.3 opens an implementation to an attack based on replay of the current-OTP part of the response. So yes, requirement 3 is doing real work, don't ghost it 👻

6. Acknowledgments 🌸

Like RFC 1938, the protocol described in this document was created by contributors in the IETF OTP working group. Shoutout to the whole crew 🫶

Specific contributions were made by Neil Haller, who provided input on the overall design requirements of a re-initialization protocol. Denis Pinkas suggested several modifications to the originally proposed re-initialization protocol. Phil Servita opened the debate with the first real protocol proposal and provided lots of specific input on the design of this and earlier protocols, so he's basically the OG here 👑

The extensions to the OTP challenge were suggested by Chris Newman and John Valdes ✨

Randall Atkinson and Ted T'so also contributed their views to discussions about details of the protocol extensions in this document. Everyone who threw in their two cents gets a gold star ⭐

References 📚

  • [RFC 822] Crocker, D., "Standard for the Format of ARPA Internet Text Messages," RFC 822, August 1982.
  • [RFC 1825] Atkinson, R., "Security Architecture for the Internet Protocol," RFC 1825, August 1995.
  • [RFC 1938] Haller, N. and C. Metz, "A One-Time Password System," RFC 1938, May 1996.
  • [RFC 2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Level," RFC 2119, March 1997.

Author's Address 🖋️

Craig Metz
The Inner Net
Box 10314-1936
Blacksburg, VA 24062-0314
(DSN) 354-8590
cmetz@inner.net

Appendix: Reference Responses 🧚

The following responses were generated by a development version of the One-Time Passwords in Everything (OPIE) implementation of this specification. Behind-the-scenes receipts, very cute 💜

All of these are responses to the challenge:

otp-md5 499 ke1234 ext

Note that the re-initialization responses use the same secret pass phrase for new and current and a new seed of "ke1235". Also, these responses have been split for formatting purposes into multiple lines; they MUST NOT be multiple lines in actual use. Keep each one on a single line, periodt 🙅‍♀️

The secret pass phrase for these responses is:

This is a test.

The OTP standard hexadecimal response is:

5bf0 75d9 959d 036f

The OTP standard six-word response is:

BOND FOGY DRAB NE RISE MART

The OTP extended "hex" response is:

hex:5Bf0 75d9 959d 036f

The OTP extended "word" response is:

word:BOND FOGY DRAB NE RISE MART

The OTP extended "init-hex" response is:

init-hex:5bf0 75d9 959d 036f:md5 499 ke1235:3712 dcb4 aa53 16c1

The OTP extended "init-word" response is:

init-word:BOND FOGY DRAB NE RISE MART:md5 499 ke1235:  RED HERD
NOW BEAN PA BURG

Copyright (C) The Internet Society (1997). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🦋

📦 where this page comes from