Do all Authenticator Apps use the same algorithm?

Question

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?

So, these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

Time-based password algorithm is indeed a standard: https://tools.ietf.org/html/rfc6238 — George Y., Sep 22 '18 at 07:14
Thank you. I thought that each application use their own algorithm. — mongkonsrisin, Sep 22 '18 at 07:45
That would destroy usability. Making it easy to use is a major factor in increasing 2FA use. — vidarlo, Sep 22 '18 at 08:51

score 12 · Accepted Answer · edited Oct 07 '21 at 08:14

these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ?

Yes.

There are two commonly used protocol for authenticator apps:

HOTP (HMAC-based one time password), which is specified in RFC 4226
TOTP (Time-based one time password), which is specified in RFC 6238

The algorithms for the two protocols are specified in open standards, so yes, all implementations of it are inter compatible.

score 3 · Answer 2 · answered Sep 25 '18 at 02:05

All of the apps you listed share an algorithm. This allows them to be compatible and largely interchangeable.

However, there are other schemes that appear nearly identical from a user standpoint but do not use the same algorithm. For example RSA Authenticate uses a proprietary algorithm which is a type of TOTP, but is not compatible with RFC 6238.

score 0 · Answer 3 · answered Aug 08 '21 at 10:17

If each app used its own algorithm, then each site would need to use a particular authenticator app since each site would need to use that algorithm.

In some cases, this does happen. Some sites and services use their own authentication app and base it on the common standards, but you can't always use another app. Steam is an example of this situation, but this is not the common or usual case.

score -2 · Answer 4 · answered Aug 09 '21 at 04:05

-2

They all use the HOTP algorithm. Before, various proprietary alogrithms were used. They seemed to be easy to exploit, so we migrated to open standards.

answered Aug 09 '21 at 04:05

DerpyCoder

1
2

2

It is not all HOTP. And what do you mean by "various proprietary alogrithms were used. They seemed to be easy to exploit" what algorithms do you mean? What exploits? – schroeder Aug 09 '21 at 07:25

Do all Authenticator Apps use the same algorithm?

4 Answers4