search

usnistgov / 800-63-3

Home to public development of NIST Special Publication 800-63-3: Digital Authentication Guidelines
https://pages.nist.gov/800-63-3/
Other
702 stars 102 forks source link

Clarify reuse of OTP authenticator outputs #1961

Open jimfenton opened 4 years ago

jimfenton commented 4 years ago

at end of -63B Section 5.1.4.1: "The OTP value associated with a given nonce SHALL be accepted only once."

Of course, the same nonce might be applied to many subscribers (e.g., a timestamp used as a nonce for TOTP authenticators). A strict reading of this requirement might limit the service to authenticating only one user during the validity period (~30 seconds).

It might be good to clarify "...associated with a given nonce/secret combination..."