# Analysis of Vulnerabilities That Can Occur When Generating One-Time Password
## 5 Analysis of OTP Vulnerabilities
### Vulnerabilities in OTP Extraction
 \tag{2}\]  
This means that whenever a random cipher text 20-byte (160-bit) is generated, there is a \(\frac{1}{16}\) probability that the above duplication occurs, resulting in a vulnerability that reduces the size of the range (That is, the probability that the extracted information is duplicated is equal to the probability that the range is reduced.). Similarly, even if the data is duplicated only 2 times instead of 3 times, this process reduces the range and increases the predicted probability. Moreover, when converting from extracted 3-bytes (24-bits) to 6-digit decimal number, the ideal probability that each appears as output in the range is as follows. Let \(N\geq m\geq 1\) be integers, and let \((q,r)=IntDiv(N,m)\) (or \(N=mq+r\)). And let the random variable \(X\) be uniformly distributed over \(Z_{N}\). For \(z\) in \(Z_{m}\), let: \(P_{\{N,m\}}(z)=Pr[X\bmod m=z:X\) randomly picked in \(Z_{N}]\)[23]. Then for any \(z\) in \(Z_{m}\),  
\[P_{\{N,m\}}(z)= \begin{cases}\frac{q+1}{N},&\text{if }0\leq z<r\\ \frac{q}{N},&\text{if }r\leq z<m\end{cases}  \tag{3}\]  
Similarly, \(Pr[X\bmod 10^{6}=z:X\) randomly picked in \(Z_{2^{24}}]\) is  
\[P_{\{2^{24},10^{6}\}}(z)= \begin{cases}\frac{16+1}{2^{24}},&\text{if }0\leq z<77 7216\\ \frac{16}{2^{24}},&\text{if }777216\leq z<999999\end{cases}  \tag{4}\]  
In other words, the ideal probability is approximately \(1/2^{20}\). On the other hand, if the above-mentioned vulnerability occurs, the probability of each element in the set \(R\) is converted is as follows. \(Pr[X\bmod 2^{8}=z:X\) randomly picked in \(Z_{2^{24}}]\) is  
\[P_{\{2^{24},2^{8}\}}(z)= \begin{cases}\frac{2^{16}+1}{2^{24}},&\text{if }0\leq z <0\\ \frac{2^{16}}{2^{27}},&\text{if }0\leq z<256\end{cases} \approx\frac{1}{2^{8}} \tag{5}\]Since there is no situation where the integer r satisfies \(0\leq r<0\), it is only in the range \(0\leq z<256\). In other words, the ideal probability is \(\frac{1}{2^{8}}\). Therefore, if the above mentioned vulnerability occurs, then the probability of each number appears is about 4000 times higher than that of an ideal situation, which occurs in 1 out of 16 cases. As mentioned in the first part of this paper, OTP is used for authentication purposes in various ways, and is particularly widely used in online banking. If an attacker attempts to attack an online banking system that follows this vulnerability, the attacker can significantly reduce the number and time of OTP predictions. In general, an authentication system that performs user authentication through OTP defines Time-To-Live (TTL); this limits the OTP value to be valid only for a specific time. Therefore, in order to succeed in the attack, he must find a valid value within the timeframe. According to the above analysis, the probability of an attacker succeeding in prediction increases significantly from \(\frac{1}{2^{23}}\) to \(\frac{1}{2^{8}}\). This extraction method is vulnerable in terms of unpredictability, although specified in the standard. The standard for OTP-related TTA [21] was issued in 2012, and even RFC 2289 [22], 4226 [23], and 1760 [1] were published between 1995 and 2005 and have not been updated to date. Standards for generating and applying cryptographic random numbers, such as NIST's SP800-90 series [12; 19; 20], have only been steadily revised in recent years. In 2015 and 2018, 90A and 90B were released as final versions, and 90C is still in draft. Thus, in the field, the period focused on various properties of cryptographic random numbers (predictability and bias, independence, entropy, etc.) is not long. And only recently has the trend to deal with the security of random numbers in depth. Therefore, looking at the OTP standards of RFCs and TTAs from a modern point of view can reveal vulnerabilities that have not been identified in the past. To solve this problem, we suggest the following solutions.