# Analysis of Vulnerabilities That Can Occur When Generating One-Time Password
## 6 Results and Discussion
### Discussion  
Based on this, we define the eccentricity, \(e\), as a relative measure of how far it is from normal, as \(\frac{MAX(X)}{H}\), which gives us the last column in Table 3. The larger the range, the closer e becomes to 0 in the control group, but it becomes larger than 2 in the experimental group. This means that the closer you get to the OTP that people use in real life, the less random the data in the Improved algorithm is. In other words, OTP can provide sufficient randomness because the greater the range, the smaller the uniform probability of the elements that can be mapped. However, when using this (improved) algorithm, the range is frequently reduced, leading to a sharp increase in the probability that certain 256 elements will appear.  
Combining Experiments 1 and 2, if an attacker wants to predict the value of OTP using the improved algorithm, the value of OTP can be predicted with probability \(\frac{1}{28}\), which is much higher than \(\frac{1}{20^{2}}\). From the point of view of \"Generating secure OTP values\", in order to alleviate the problems presented in Vulnerabilities 1 and 2 and Experiments 1 and 2 against them, we recap the solution we proposed.  
* Enhance the generation algorithm: When generating an OTP, a cryptographic algorithm that provides security strength suitable for the current era should be used. As shown in Table 2 above, there are methods to use hash functions such as SHA2 and SHA3 that provide 112-bit or higher security strength, or block ciphers such as AES-128,192,256. It is also okay to use standard cryptographic algorithms defined by the country that implements the OTP service;in Korea, LEA-128,192,256, ARIA-128, 192, 256, etc. can be used.
* Use of static or dynamic algorithm: We should not use the improved algorithm. Using this algorithm increases the probability of predicting the value of OTP. In cryptosystems, OTP is widely used because of its advantages; the value is valid only once, has randomness, and can not predict the next value. However, if the values can be easily predicted as in the results of Experiments 1 and 2, the meaning of using this will fade. Therefore, static and dynamic algorithms should be used instead of improved algorithms that eliminate these advantages.
* Increase the amount of extraction to 4-byte: Increase the OTP extraction range. This way, we can also use digits where the number change is not large, so that we can reduce the probability of prediction each time we increase one digit. When the amount of extraction is increased from 3-byte to 4-byte, the range is [0, 16777215] (i.e., \([0,2^{24}-1]\)) to [0, 4294967295] (i.e., \([0,2^{32}-1]\), About 4 billion cases). Therefore, OTP can be used up to 7 and 8 digits instead of 6 digits. In this case, since \([0,10^{7}-1]\) and \([0,10^{8}-1]\) can be used, the predictable probability decreases by 1/10 each time by one digit increment.
* Increases the number of LSB digits used as extraction information, and increases the length of the output bit string accordingly: Since 16 offsets can be selected using LSB 4-bit (\(2^{4}\)) extraction information, the length of the output bit stream is used as 20-bytes (=16 + 4). Here, adding 4 to the length to be extracted has this meaning. Suppose that when the dynamic algorithm is used, the maximum value that can be expressed in 4 bits is 15.At this time, if 3-byte data is extracted, it becomes \(arr[15]||arr[16]||arr[17]\), and if 4-byte is extracted, it becomes \(arr[15]||arr[16]||arr[17]||arr[18]\). If 4 is not added to the length, there is insufficient extraction data and a memory overflow occurs, or the data at the last offset used for extraction information is accessed again. That way, the data is not independent. When LSB is used as 5-bit or 6-bit, it is also appropriate to generate at least 4-byte additionally. In this case, the probability of offset overlapping decreases by \(\frac{1}{2}\) each time the bit is increased by one.