6

It seems really simple, but who invented the commonly-used otpauth:// scheme (used by Google Authenticator and other TOTP soft tokens by scanning QR codes)? When?

  • 2
    Please share with us some of the research that you have already done. – Deer Hunter Sep 5 '13 at 20:39
  • 1
    I searched Google for otpauth uri and found this page - code.google.com/p/google-authenticator/wiki/KeyUriFormat. Is this describing an existing format, or did Google invent the format? – Jacob Krall Sep 5 '13 at 22:16
  • 1
    Did you manage to find an answer for this one? – fuglede May 5 '15 at 12:31
  • I haven't been able to find any origin for it before Google, and it's not on the IANA registered schemes list so probably isn't formalized in an RFC anywhere. – Todd Knarr Jul 2 '16 at 4:26
6

"Let's get into the Wayback machine, Sherman."

otpauth:// starts with Google as nearly as I can find, in https://github.com/google/google-authenticator/commit/6649dd33687c5561663fb242a05f6949cf4d543f, dated Mar 25, 2010. But the initial commit says it was to 'Import BlackBerry source code and project files.' So it came before...

The formal root of all this is RFC-2289 "A One-Time Password System" that was pulled together by the Network Working Group by Haller (Bellcore), Metz (Kaman Sciences Corporation), Nesser (Nesser & Nesser Consulting) and Straw (Bellcore), copyrighted in February 1998 by 'The Internet Society'). (https://tools.ietf.org/html/rfc2289)

In this document, Haller's paper is referenced "The S/KEY One-Time Password System" in the Proceedings of the ISOC Symposium on Network and Distributed System Security, in February 1994. (http://zoo.cs.yale.edu/classes/cs422/2014/bib/haller94skey.pdf)

This document references the UNIX skey command, "S/key -- a procedure to use one time passwords for accessing computer systems" by Karn, Haller, Walden, and Chasin, with the earliest online generation found in October 1993. (http://www.sbras.ru/cgi-bin/www/unix_help/unix-man?skey+1)

Phil Karn worked at Bell Labs and BellCore, and wrote most of the skey unix software. He since has been working on many Internet systems with security concerns, and is now at Qualcomm. Neil Haller worked at Bell Labs and BellCore and carried the skey flag forward. Haller was born in 1937 and passed in 2011. John Walden created the first MS-DOS CLient version of skey. Scott Chasin was at Bellcore in 1993 and contributed to skey. He has since gone on to head several companies some more and some less connected to computer security.

Skey was based on original work by Leslie Lamport, an ACM Turing Award recipient, who developed a method for creating digital signatures ("Constructing digital signatures from a one way function." Technical Report SRI-CSL-98, SRI International Computer Science Laboratory in October 1979 and , "Password Authentication with Insecure Communication", Communications of the ACM 24.11 in November 1981.) As a sidenote, where quantum communications looks to be able to hack passwords, Lamport signatures may not be breakable under sufficient conditions. (https://en.wikipedia.org/wiki/Leslie_Lamport and https://en.wikipedia.org/wiki/Lamport_signature)

Skey has fallen from prominence as schemes that feature two-factor authentication are becoming adopted. But it is the realization of Lamport's one-time-password authentication by the gang of scientists at Bell Labs.

We all stand on the shoulders of giants.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.