In this day and age, hacker attacks are an all too common occurrence. This is why it is more important than ever to keep data secured but without making it significantly harder to access. Multi-factor authentication is a tool that allows you to do precisely that.

Security should be a topic for everyone (individuals and companies). One major problem is that there is often just one (1) password or certificate/key used. If this information is stolen, the thief can authenticate on all the systems. This is where multi-factor authentication, also known as two-factor authentication, comes into play. The goal is to have several factors which, ideally, are never stored together in one place. If one of the factors is also a dynamic one (one-time password or challenge-response protocol), then that should also prevent what is known as “replay attacks”.

Multi-factor authentication can generally also be done with a password and certificate. E.g. for SSH, with a password and RSA key and on the web with a password and x509 certificates. In the following, however, we will deal with one-time passwords and challenge-response protocols which require an additional hardware component. The idea is to use a password (the knowledge factor) and a hardware component (the possession factor) to prevent simple theft.

FIDO U2F

FIDO U2F is a very new protocol based on public key cryptography. It requires native support in the browser (currently only in Chrome / Chromium and via add-on in Firefox). Theoretically, it can also be used for SSH and other services. In this case, the programs would still have to support it natively. Relevant patches are already available for the OpenSSH client.
Following successful authentication by password or certificate, the server sends the client a one-time challenge. The client replies by sending the server a response signed with their own personal key.

OATH

With OATH, there are two protocols – the time-based one-time password algorithm TOTP (RFC6238) and the HMAC-based one-time password algorithm HOTP (RFC4226).

First, a shared secret is exchanged between server and client. This is often done using a QR code.

TOTP

With TOTP, the time of day is used as a basis. The prerequisite is that the time be synchronised for server and client.
The authentication code is generated using the following function: HMAC(sharedSecret, timestamp) and is valid for 30 seconds.

HOTP

HOTP functions the same way as TOTP but, instead of the time, it uses a counter which must always be synchronised between server and client.
The authentication code is generated using the following function: HMAC(sharedSecret, counter) and is valid for the next login (with no time limit).

One-time password (OTP)

One-time passwords (OTP) are a simple method from Yubico, which require additional infrastructure in the background. Following successful authentication by password or certificate, the server further requests an OTP. If the OTP is sent, the server must forward it to a validation server for verification.

For example, three OTPs from the same Yubikey might look like this:
<b>rjvrllbbckhe</b>flnbdhnbdgluhedfneecjrluudknuecu
<b>rjvrllbbckhe</b>nrvblgfvkcbdhbtnjegvdicnhcutundg
<b>rjvrllbbckhe</b>lvrdjdrjccrvkrlbiijictlullglfglj
The first 12 characters of the sequence are the public name and the rest of the sequence is generated based on an AES key and a counter. The AES key must be known to the Yubikey and the validation server (specifically to the yubikey-ksm).
For each OTP, the counter is also provided, so that the server can synchronise its counter.

Validation server

The Yubico validation server software yubikey-val and yubikey-ksm is easy to host yourself. But you can also use the YubicoCloud, which is hosted and offered by Yubico.
When it comes to critical infrastructure, it certainly makes more sense from a security perspective to host the software yourself. It’s not so much about data protection as availability. If, for example, the internet connection is interrupted and, in order to repair the firewall, you would need to log in using two-factor authentication with OTP, you would end up in a deadlock and have no connection to the internet.