# Analysis of Vulnerabilities That Can Occur When Generating One-Time Password
## 5 Analysis of OTP Vulnerabilities
### Vulnerabilities in OTP Extraction  
The improved dynamic extraction algorithms can be vulnerable to OTP generation. Figure 5 illustrates a situation where a vulnerability can occur in that case. The improved dynamic algorithm derives new extraction information from the location indicated by the value based on the predetermined extraction information. However, in this process, if the first extraction information and the next one are the same, all three bytes of the extraction data are duplicated. For example, when the least significant byte \(arr[19]\) of the cipher text is 0x42, the extraction information is 0x02, which is LSB 4-bit, and the first extraction data is \(arr[2]\). Then, LSB 4-bit of \(arr[2]\) is the second extraction information. At this time, if the LSB 4-bit of \(arr[2]\) is also 0x02, the second extracted data is \(arr[2]\) again. The third and last process is the same. As a result, a total of three bytes are duplicated. Example output is \(arr[2]||arr[2]||arr[2]\). If all the extracted data values are duplicated in the above situation, OTP range is a set of elements that is \(arr[i]||arr[i]||arr[i]\) (0x00 \(\leq arr[i]\leq\) 0 xFF, [0, 255]) form. If this reduced set is called R, then \(|\)R\(|\) Becomes 256, so \(|\)R\(|\) is reduced by approximately 99% compared to [0, 99999] (i.e., \([0,10^{6}-1]\)), making it easier to predict the random numbers that can be output. The following assumptions are made to analyze the probability that this situation can occur. * Store the cipher text 160-bit in the array \(arr[]\), which is 8-bit in size. * For the integer \(t\in[0,19]\), the lower 4-bits of \(arr[t]\) are expressed as \([arr[t]]_{4}\). * If \([arr[19]]_{4}=i\), then \(arr[i]\) is used as the first extraction data. * If \([arr[i]]_{4}=j\), then \(arr[j]\) is used as the second extraction data. * If \([arr[j]]_{4}=k\), then \(arr[k]\) is used as the third extraction data. In this case, the probability that a duplicate situation occurs in the extraction algorithm can be obtained as follows. Since the bit string is the output of the encryption algorithm, i.i.d is satisfied \begin{table}
\begin{tabular}{c l l} \hline \hline
**Security** & **Digital Signatures and Hash-Only** & **HMAC, Key-Derivation Functions,** \\
**Strength** & **Applications** & **Random Number Generation** \\ \hline \(\leq\)80 & SHA-1 & \\
112 & SHA-224, SHA-512/224, SHA3-224 & \\
128 & SHA-256, SHA-512/256, SHA3-356 & SHA-1 \\
192 & SHA-384, SHA3-384 & SHA-224, SHA-512/224 \\ \(\geq\)256 & SHA-512, SHA3-512 & SHA-256, SHA-512/256, SHA-384, \\  & & SHA-512, SHA3-512 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Hash functions that can be used to provide the targeted security strengths. Figure 5: Case for vulnerabilities in Improved Dynamic Extraction Algorithm. between all bits. That is, each bit is independent and the probability of getting 0 or 1 is \(\frac{1}{2}\). \(Pr[\text{All extraction information is duplicated}]\) is  
\[ \begin{split}& Pr[\text{output of extraction}=(arr[i]||arr[i]||arr[i])]\\ &=\sum_{i=0}^{15}Pr[[arr[19]]_{4}=i,[arr[i]]_{4}=i,[arr[j]]_{4}=i] \\ &=\sum_{i=0}^{15}Pr[[arr[19]]_{4}=i,[arr[i]]_{4}=i]\\ &=\sum_{i=0}^{15}Pr[([arr[19]]_{4}=i)\times([arr[i]]_{4}=i)],( \because i.i.d)\\ &=\sum_{i=0}^{15}\frac{1}{16}\times\frac{1}{16}\\ &=16\times\frac{1}{16}\times\frac{1}{16}=\frac{1}{16}\end{split}  \tag{1}\]  
In addition, the probability through the total number of cases can be obtained. \[ \begin{split}& Pr[\text{All extraction information is duplicated}]\\ &=\frac{\text{the number of cases where the lower 4-bits of the two positions are the same}}{\text{the number of total cases of 160-bit string}}\\ &=\frac{2^{152}\times 2^{4}\times 1}{2^{160}}=\frac{1}{16}\end{split}