Use TOTP instead of fixed password

[stettler]

Hello,
Would it be possible to add TOTP? Instead of configuring the server to accept a fixed password, it would be a lot more secure if fwknopd would accept a TOTP password (no need to change anything to the client).

[e40]

What I do is keep my password in 1Password and use their Homebrew-based CLI to retrieve it and knock via a script.

[stettler]

But that still a fixed password... What I mean is that instead of setting a fixed "KEY" on the server side and asking for that "KEY" from the client, we could use a time based OTP. That way, the "KEY" would change regularly and there would be no need for a fixed password.

[e40]

But that still a fixed password... What I mean is that instead of setting a fixed "KEY" on the server side and asking for that "KEY" from the client, we could use a time based OTP. That way, the "KEY" would change regularly and there would be no need for a fixed password.

I agree. I didn't say, but I was assuming the feature was desired because storing a password for automatic knocking is insecure. However, I agree, it's a good feature.

[ricoandreaslepp]

I have started work on trying to integrate TOTP with the fwknop software. One issue that I am currently facing is that fwknop leverages AES for the packet encryption, which has a fixed-length secret. I am trying to find out ways for generating the secret through a key-derivation function from a given TOTP, I am not yet sure about the security implications of this.

Due to the usage of AES, the client application would still need additional code for the key-derivation as well, which has to match the function used by the server for the decryption to succeed. This is not ideal in my mind, as I was hoping to make it work with any client, without needing to alter the code, but I have not found a way to do this.

[yangcancai]

@ricoandreaslepp TOTP can be used as a seed for hash verification, in fact, there is no need to decrypt, only encrypt. I also plan to modify fwknop to support TOTP.

[ricoandreaslepp]

@yangcancai I used the TOTP to generate a password with hash-based key derivation. I have already implemented it since I am working on this for my thesis. It is WIP, but the underlying TOTP mechanism works already.

If you have any more great ideas, you can check my fork: https://github.com/ricoandreaslepp/fwknop-totp

[yangcancai]

@ricoandreaslepp awsome