TOTP: How Authenticator Codes Work
Subtitle: A shared secret plus a shared clock, no network needed
- Panel 1 - ENROLL AND VERIFY (full-width swimlane sequence diagram). Actors as labeled vertical lanes with dashed lifelines: PHONE APP | SERVER | SECRET STORE | CLOCK. Numbered steps with labeled arrows:
- Server makes random secret K, shows QR
- Phone scans otpauth:// URI, stores K
- Both read the same UTC clock
- Phone computes 6-digit code from K and time
- Server recomputes and compares codes
Panel 2 - THE ALGORITHM (RFC 6238):
K = shared secret, Base32 encoded T = floor(unix time / 30) HMAC-SHA1(K, T) gives 20 bytes Dynamic truncation to 31-bit int int mod 10^6 gives 6 digits
Panel 3 - WHY IT WORKS OFFLINE:
Nothing is sent to generate a code Both sides share time, not messages The secret never leaves the device Each code lives about 30 seconds Server allows only a small drift window
Panel 4 - COMMON MISTAKES:
Accepting the same code twice Drift window too wide, plus or minus 10 No rate limit, so 10^6 is guessable Storing K in plaintext at rest No backup codes, users get locked out
Callout box: Simple idea: a password proves what you know, TOTP proves you still hold the secret right now.