I'm doing TOTP verification using Node + Redis and trying to figure out how to implement clock drift synchronization. I'm using hardware devices to generate the TOTP passcodes/tokens but need to account for clock drift of these hardware devices when verifying the tokens. I've read the RFC and other blog posts and from a high level I think I understand the algorithm for adjusting for clock drift in terms of time steps, but I can't figure out in which cases the tokens should fail verification and/or which flags I should be setting in the DB to tell me so. Any ideas? Or even better, could anyone point me to some links of example code where people have implemented this?
1 Answers
clock drift adjustments can be performed either during authentication, or by getting the user to supply two or more consecutive OTP codes. Either way the codes are checked against expected OTP codes and the time the drift is calculable by comparison (if code 1234 is supplied at 1pm but the matching code requires a 1:10 pm timestamp then there is a 10 minute drift).
Related