This document discusses building your own web-based time-based one-time password (TOTP) authenticator using Python, HTML, Google Identity-Aware Proxy (IAP), Compute Engine, and SQLite. It provides background on multi-factor authentication (MFA) and the cryptographic techniques HMAC and TOTP. The project aims to create an easy way to generate one's own TOTP codes as an alternative to proprietary authenticator apps, while future work could involve using HMAC to generate random URLs.

1. Building your own web based TOTP

2. Varun Kondagadapa
I’m a:
● Blogger
● Docker superuser!
● Complex gitlab plugins
and pipelines
● Python/C# Programmer
● Zerotrust phase 1
● DevSecOps
● Microsoft fan but use
Linux
I’m not a:
● Bug hunter
● Malware researcher
● ML guy
https://www.reborninfosec.com/

3. Stop Me!
You have every
right to Stop
me!

4. MFA : Multi Factor Authentication
● Secure from Password stealing attacks
● Sms, App, h/w tokens etc..
● Compliance requirement i.e eg: PCI DSS
● Implemented independently i.e isolated from actual authentication
Little cautious:
● Loss of Tokens, keys, mobile can be problematic

5. HMAC: Hash based message authentication code
● Keyed-Hashing for Message Authentication
● Hashing with private key
● HMAC = Key + Message + Hash
● Similar to Digital signature but uses symmetric keys
● Hashes can establish integrity but not authenticity
● Issue: Collision-related vulnerabilities of MD5

6. TOTP : Time based OTP
● Uses HMAC
● NIST discourages SMS
● Offline sync
● Works with unix time
● Open standard : One can create their own
Challenge:
● Keeping the shared key

7. Authenticator
● Most installed tool for storing otps
● Earlier open source but now proprietary
That one drawback:
● What happens when we lose our phone
● No backups

8. The Project
● Python
● Html
● Google IAP
● Compute Engine
● Sqlite

10. Conclusion
● Cryptographic techniques are open to adopt
● An easy way to create our own google authenticator
Future Work
HMAC for random url generator

11. References
● https://stackoverflow.com/questions/8529265/google-authenticator-implement
ation-in-python
● https://www.jscape.com/blog/what-is-hmac-and-how-does-it-secure-file-transf
ers
● https://cloud.google.com/iap/docs/