Two-Factor Authentication System
Two-Factor Authentication System
CHAPTER ONE: INTRODUCTION
1.1 Background of the Study
In today's hyper-connected digital ecosystem, online applications manage sensitive personal information, financial transactions, enterprise resources, and confidential communications. Traditionally, digital security has relied on single-factor authentication (SFA)—primarily static passwords—to verify user identity. However, static passwords represent one of the weakest links in cybersecurity. Users frequently reuse simple passwords across multiple platforms, write them down, or fall victim to sophisticated attacks such as phishing, credential stuffing, keylogging, and automated brute-force dictionary attacks. Once a attacker acquires a user's password, the integrity of the target system is fully compromised.
To address the vulnerabilities of single-factor authentication, security architectures have evolved toward Multi-Factor Authentication (MFA), specifically Two-Factor Authentication (2FA). Two-factor authentication enforces security by requiring two distinct identity claims before granting system access:
1. Something You Know: The primary password or secret PIN.
2. Something You Have: A physical or digital possession, such as a time-based authenticator mobile application (e.g., Google Authenticator, Microsoft Authenticator) generating Time-based One-Time Passwords (TOTP), an SMS/Email security code, or a hardware security key.
By combining primary credential verification with a dynamic, short-lived token generated by an independent possession factor, 2FA drastically reduces the risk of unauthorized account takeovers, even if primary passwords are compromised.
1.2 Statement of the Problem
Despite the clear security benefits of multi-factor authentication, implementing a reliable, user-friendly, and secure 2FA framework introduces technical and operational challenges:
• Vulnerabilities in Legacy Channels: SMS-based 2FA is susceptible to SIM-swapping attacks, SMS interception, and telecommunication network eavesdropping, making it inadequate for high-security applications.
• Account Lockout and Recovery Friction: Users who lose access to their secondary factor (e.g., lost or damaged mobile device) face complete system lockout unless secure, single-use backup recovery mechanisms exist.
• Replay and Timing Attacks: Weakly implemented TOTP verification algorithms can suffer from clock-skew errors, token reuse window vulnerabilities, or side-channel timing attacks during secret comparison.
• Usability and Implementation Friction: Complex or poorly integrated 2FA enrollment workflows cause user friction, resulting in low adoption rates or unsafe workarounds.
1.3 Aim and Objectives
• Aim: The aim of this project is to design, implement, and evaluate a secure Two-Factor Authentication System utilizing Time-based One-Time Password (TOTP) protocols (RFC 6238), automated QR code enrollment, backup recovery code generation, and secure session handling.
• Objectives: The specific objectives are to:
1. Conduct a comprehensive requirement analysis for user registration, primary password authentication, TOTP secret provisioning, and dynamic token validation workflows.
2. Design a three-tier software architecture and a normalized relational database schema to store hashed credentials, encrypted TOTP secrets, recovery tokens, and security audit logs.
3. Implement backend API services capable of generating cryptographically secure base32 secrets, rendering enrollment QR codes, and verifying 30-second TOTP tokens with time-drift window tolerances.
4. Develop a responsive user interface allowing users to enroll in 2FA, scan QR codes using standard mobile authenticator apps, manage single-use emergency recovery codes, and track account security status.
5. Test and evaluate the deployed 2FA system for token validation accuracy, resilience against replay attacks, time synchronization drift tolerance, and execution latency.
1.4 Significance of the Study
This project provides substantial value to enterprise software development and cybersecurity practice. For organizations, it offers a self-contained, open-standard blueprint for augmenting legacy password authentication with enterprise-grade 2FA without incurring third-party API subscription costs. For software engineers, it demonstrates practical implementation patterns for cryptographic key exchange, TOTP counter synchronization, single-use recovery code management, and token-based session security using JSON Web Tokens (JWT).
1.5 Scope and Limitations
• Scope: The project covers user registration, bcrypt password hashing, base32 TOTP key generation, QR code rendering, token clock-skew validation, emergency backup recovery code generation, and session issuance via JWT.
• Limitations: The primary focus is software-based TOTP verification (RFC 6238). It does not natively implement hardware security keys (FIDO2 / WebAuthn) or SMS-based cellular gateways.
CHAPTER TWO: LITERATURE REVIEW
2.1 Conceptual Framework
A Two-Factor Authentication system operates on the principle of identity verification through orthogonal authentication factors. This framework relies on key cryptographic standards:
• Time-based One-Time Password (TOTP - RFC 6238): An extension of the HMAC-based One-Time Password (HOTP) algorithm (RFC 4226), where counter increments are derived from moving time intervals (T) rather than event counters:
T=⌊TxTcurrent−T0⌋
Where Tcurrent is the Unix timestamp, T0 is the start time (0), and Tx is the time step window (typically 30 seconds).
• Cryptographic HMAC Calculation: The TOTP token is generated by computing an HMAC-SHA1 or HMAC-SHA256 digest of the secret key K and time step counter T, followed by dynamic truncation to extract a 6-digit numerical code:
TOTP(K,T)=Truncate(HMAC-SHA1(K,T))(mod106)
• Shared Secret Provisioning via QR Code: The application server generates a high-entropy secret key K, converts it to a uniform URI schema (otpauth://totp/Issuer:User?secret=K&issuer=Issuer), and renders it as a QR code for seamless scanning by client authenticator applications.