One-time passwords (OTP)

Ironchip OTPs (one-time passwords) generate TOTP codes that comply with RFC 6238. They work as a second factor in any service protected by Ironchip, and they are compatible with the Ironchip app and with any authenticator app that implements that standard.

Requirements

Access to the Ironchip admin console with the administrator role.
The Ironchip app (mobile or desktop) installed on the user’s device, or any authenticator app compatible with RFC 6238.
To protect the seed: a device with a TPM (Windows), Android Keystore, or Secure Enclave and Keychain on iOS.

Create an OTP

Open the Ironchip mobile app and go to the bottom bar section with the padlock-and-arrow icon.
Tap the + button and select one of these options:
- Scan a QR code: scan the OTP’s QR code with the phone camera.
- Enter URL: enter the OTP’s setup URL.
- Enter setup key: manually enter the OTP’s setup key.

Once added, the OTP is created and the app starts showing its codes.

The OTP’s time validity window is set when you generate it and stays tied to it. To change it, delete the OTP and create a new one with the window you want.

Use the OTP

Once enrolled, the user uses the OTP as a second factor in any service protected by Ironchip, such as access to network devices through TACACS+, a VPN or a web application.

When the service asks for the second factor, the user opens the app, reads the current code and enters it. Ironchip calculates it again from the OTP key and validates it, accepting the periods included in the validity window set when the OTP was created.

For SSH access to a device with TACACS+, enter the code in the password field. To check it from the device itself, run:

test aaa group ironchip-group <user> <OTP code> legacy

The validation is rejected in these cases:

Expired code: its period has passed and it is outside the validity window, or the device clock is out of sync. Wait for the next code and check that the device time is set automatically.
Code already used: each code can only be validated once. Wait for the next code.
Deleted OTP: an administrator has revoked it. Enroll a new OTP.
Suspicious context: ITDR blocks the attempt because of the location, device or time, even if the code is correct.

All validations, successful or rejected, are recorded in the Events section of the console and can be exported through event export.

OTP protection

Ironchip OTPs are protected against token cloning, phishing and credential reuse.

Code generation relies on the secure hardware of each platform. The OTP key is never stored in clear text and is protected by that hardware, so it cannot be copied to another device:

Windows (desktop app): TPM (Trusted Platform Module). The key is encrypted with a key generated and protected by the TPM, bound to the computer, and it cannot be decrypted outside it.
Android: Android Keystore, with StrongBox or TEE depending on the device. It is the equivalent of the TPM on the phone: the key that protects the OTP is generated inside the secure hardware and cannot be exported.
iOS: Secure Enclave and Keychain. It is the equivalent of the TPM on the iPhone: the key that protects the OTP is generated in the Secure Enclave and the OTP is stored in the Keychain, accessible only on that device and while the device is unlocked.

Because it is bound to the device, the OTP is not transferred with a backup or when migrating to another phone. In that case, enroll a new OTP.

In addition, Ironchip ITDR controls the use of OTPs:

Anti-reuse: a code that was already used within its validity window is rejected and the attempt is recorded.
Anti-phishing: ITDR evaluates the location, device, time and usage patterns of each authentication, and blocks it or requires an additional verification if the behavior is anomalous, even if the code entered is correct.
Anti-cloning: if the same OTP is used from incompatible contexts, for example distant locations within a short interval, ITDR detects it and lets you revoke it.

You can export these events to your SIEM through ITDR event export.

Delete and reassign an OTP

Open the Ironchip mobile app and go to the bottom bar section with the padlock-and-arrow icon.
Swipe the OTP to the left and tap the red trash can.

Once deleted, the app stops showing the codes of that OTP.

To reassign it to another device, or to create one with a different validity window, delete the previous OTP and enroll a new one on the target device by following the steps in Create an OTP.

Was this page helpful?