Search code examples
algorithmhttpsecuritytokentotp

Does the TOTP Algorithm rely on the client time always being synced correctly?


What happens if for some reason a cell phones clock / calendar is off by a significant amount of time. Does the TOTP (Time based OTP) algorithm generate an invalid token? Also do time zones play a role in the token being correct or does both the client and the server talk to a Network Time Protocol server to ensure that everything is synced up?


Solution

  • Yes, if the clocks are out of sync then the totp will not validate. But unless you know that the client clock is wrong and the server clock correct, it is not semantically correct to say that the token is invalid.

    No, time zones are not relevant provided that the systems are setup correctly - both devices should base the hash on a common datum. UTC or GMT is commonly used. It's possible to have your computer showing the right wall clock time but be configured in the wrong time zone. If this is the case, it won't be able to convert the time to the common timezone correctly.

    Using NTP is one solution to keeping accurate time (and a cheap one if you have an internet connection) but there are other solutions.

    How much clock jitter the authentication will support is dependent on the implemented algorithm.