菜单
RFC 6238 - TOTP: Time-Based One-Time Password Algorithm. Extends HOTP (RFC 4226) by using time as the moving factor instead of a counter, enabling time-synchronized OTP generation. Use when working with TOTP, time-based authentication, Google Authenticator, or OATH time-based standards.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
| name | rfc6238 |
| description | RFC 6238 - TOTP: Time-Based One-Time Password Algorithm. Extends HOTP (RFC 4226) by using time as the moving factor instead of a counter, enabling time-synchronized OTP generation. Use when working with TOTP, time-based authentication, Google Authenticator, or OATH time-based standards. |
Title: TOTP: Time-Based One-Time Password Algorithm
Authors: D. M'Raihi, S. Machani, M. Pei, J. Rydell
Published: May 2011
Category: Informational
Source: RFC 6238
RFC 6238 describes an extension of the HOTP (HMAC-Based One-Time Password) algorithm defined in RFC 4226 to support a time-based moving factor. While HOTP uses an event counter as the moving factor, TOTP replaces this with a time value derived from the current Unix time and a configurable time step.
The time-based variant provides short-lived OTP values (typically valid for 30 seconds), which are desirable for enhanced security. The algorithm maintains interoperability with HOTP and can be used across VPN access, Wi-Fi network logon, and transaction-oriented web applications.
| Aspect | Details |
|---|---|
| Algorithm | Time-Based One-Time Password (TOTP) |
| Base Algorithm | HOTP (RFC 4226) with HMAC |
| Type | Time-based (Unix timestamp) |
| Default Time Step | 30 seconds |
| Purpose | Two-factor authentication |
| Use Cases | VPN, Wi-Fi, web applications, mobile apps |
| OATH Standard | Yes |
| Relation to HOTP | Extension (replaces counter with time) |
C is replaced by a time-based value TT = (Current Unix time - T0) / X
TOTP = HOTP(K, T)
Where:
K = Shared secret key (same as HOTP)T = Number of time steps since T0X = Time step size in seconds (default: 30)T0 = Unix time to start counting (default: 0, the Unix epoch)HOTP = The algorithm from RFC 4226With default settings (X = 30 seconds, T0 = 0):
The RFC specifies these requirements:
TOTP inherits all security properties from HOTP (RFC 4226):
While HOTP (RFC 4226) specifies HMAC-SHA-1, TOTP implementations MAY use:
| Feature | HOTP (RFC 4226) | TOTP (RFC 6238) |
|---|---|---|
| Moving Factor | Event counter | Unix time |
| Validity | Until next event | Time step duration |
| Synchronization | Counter-based | Clock-based |
| Typical Use | Hardware tokens | Mobile apps, software |
| Drift Handling | Counter resync | Clock drift tolerance |
| Example | YubiKey | Google Authenticator |
Use this skill when:
Appendix A of RFC 6238 includes reference implementations and Appendix B provides test vectors for verification.
See references/RFC6238.txt for the complete document.
RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants. Profiles the OAuth Assertion Framework (RFC 7521) to define (1) the jwt-bearer authorization grant for requesting an access token from an existing trust relationship without a user-approval step, and (2) JWT-based client authentication at the token endpoint via client_assertion. The basis for the private_key_jwt client authentication method. Use when implementing or validating signed JWT assertions for OAuth token requests, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, or iss/sub/aud/exp claim validation.
OpenID Connect Discovery 1.0 - Defines mechanism for Relying Party to discover OpenID Provider and obtain OAuth 2.0 endpoint locations. Covers Issuer Discovery, Provider Metadata, and Configuration Information retrieval. Use when working with OpenID Provider discovery, well-known endpoints, or metadata configuration.
OpenID Connect Core 1.0 - Identity layer on top of OAuth 2.0 protocol. Defines ID Token, UserInfo endpoint, authentication flows (Authorization Code, Implicit, Hybrid), claims, and standard claims for identity. Use when working with OpenID Connect authentication, identity tokens, user profile information, or OAuth 2.0 extensions for identity.
RFC 6749: The OAuth 2.0 Authorization Framework. Defines the protocol for third-party application access to HTTP services on behalf of a resource owner, introducing authorization layers, access tokens, and refresh tokens. Replaces OAuth 1.0 (RFC 5849).
RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Defines PKCE extension for OAuth 2.0 Authorization Code flow, mitigating authorization code interception attacks by introducing code_verifier and code_challenge parameters. Enables secure OAuth usage for public clients like mobile apps and SPAs.
Web Authentication Level 2 (WebAuthn) - W3C specification defining an API for strong, attested, scoped public key-based credentials. Enables passwordless authentication and phishing-resistant MFA using platform or roaming authenticators. Use when working with WebAuthn API, FIDO2, public key credentials, or browser-based authentication.