View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011663 | Taler | other | public | 2026-07-22 15:38 | 2026-07-22 15:40 |
| Reporter | MarcS | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | N/A |
| Status | new | Resolution | open | ||
| Product Version | post-1.0 | ||||
| Target Version | post-1.0 | ||||
| Summary | 0011663: Prevent replay attacks on totp | ||||
| Description | Currently it is possible to use the same totp codes for the offline coffee machine to pay for 1 coffee and receive multiple coffees. | ||||
| Additional Information | Solution: Instead of treating "nfc=1" as Bool, we will interpret 1..255 as session counter. Each time the device registers a smartphone reading NFC it will increment this session counter (reverting to 1 after 255). The merchant backend will include this counter in the input data for the totp generator, and thus can generate 255 different sets of 5 totp codes for the same timestamp. The wallet will add this session counter byte after the start byte 0x42 ("B") and before the five 4-byte totp codes when writing back the totp data to the device. The device uses the same algorithm as the merchant backend to compute the totp codes from the current timestamp, the secret and the passed on session counter byte. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-07-22 15:38 | MarcS | New Issue |
