Single-fаctоr One-time Pаsswоrds (OTPs) Single-fаctоr One-time Passwords (OTPs) are physical or soft tokens that display a continually changing pseudo-random one-time challenge. These devices make phishing (impersonation) difficult but not impossible. This type of authenticator is considered "something you have". Multi-factor tokens are similar to single-factor OTPs but require a valid PIN code, biometric unlocking, USB insertion, NFC pairing, or some additional value (such as transaction signing calculators) to be entered to create the final OTP. OTPs are essential for several reasons, significantly enhancing security in authentication processes. Here's why they are significant: Temporary and Unique: OTPs are temporary and generated for a single use, so even if someone intercepts the OTP, it cannot be reused. This limits the window of opportunity for attackers. Mitigating Password-Related Risks: OTPs reduce the risks associated with traditional passwords, such as password theft, reuse, or brute-force attacks. Since OTPs are time-sensitive and unique, they add an extra layer of protection beyond a static password. Easy to Implement: OTPs are relatively simple to implement in systems, often requiring just a phone number or email address for delivery. This makes them an accessible option for improving authentication security. User-Friendly: OTPs do not require complex knowledge from users, as they are often delivered via text message, email, or an authenticator app. This ease of use increases their adoption of security protocols. Cost-Effective Security: OTPs balance security and cost-effectiveness for many systems, as they don’t require expensive hardware tokens or complex infrastructure. Adds an Extra Layer: Even in single-factor authentication (generally less secure than multi-factor authentication), OTPs offer an added layer of security over static passwords. This makes it more difficult for attackers to gain unauthorized access. While One-time Password (OTP) systems provide an added layer of security, they also have several potential issues and limitations, which makes today's use integrated with other techniques like MFA. Given these challenges, OWASP Application Security Verification Standard 4.0.3 defines requirements for implementing an OTP system. # Description CWE 2.8.1 Verify that time-based OTPs have a defined lifetime before expiring. 613 2.8.2 Verify that the symmetric keys used to verify submitted OTPs are highly protected, such as by using a hardware security module or secure operating system-based key storage. 320 2.8.3 Verify that approved cryptographic algorithms are used to generate, seed, and verify OTPs. 326 2.8.4 Verify that time-based OTP can be used only once within the validity period. 287 2.8.5 Verify that if a time-based multi-factor OTP token is re-used during the validity period, it is logged and rejected, and secure notifications are sent to the device holder. 287 2.8.6 Verify that the physical single-factor OTP generator can be revoked in case of theft or other loss. Ensure that revocation is immediately effective across logged-in sessions, regardless of location. 613 2.8.7 Verify that biometric authenticators are limited to use only as secondary factors in conjunction with something you have or know. 308 During the vulnerability analysis (stage 5 of PASTA), we identified several vulnerabilities that could affect the security of the system's operation. The previous report describes these vulnerabilities. Create the required misuse cases diagram and design the flaw analysis using the abuse cases to define the required mitigations (at least one for each misuse case). Submission Directions: Submit the complete UML Misuse Case diagram compounded by the use cases to the system, the misuse cases, and the required mitigations. The diagram must be made using the Visual Paradigm[1]. You must create misuse cases that cover at least two threats of the system and one mitigation for each one of the misuse cases. The background of the misuse cases must be painted black. The background of the mitigation must be painted green. Submitting any diagram other than a Misuse Case will result in the question receiving zero points. Submitting handwritten diagrams will result in the student receiving zero points. [1] https://online.visual-paradigm.com/ Rubric Criteria Description Points Identification of Use Cases (5 points) Correctly identifies the key use cases (e.g., Request OTP, Submit OTP, Verify OTP, Revoke OTP Generator). Each use case should be relevant to the OTP flow. 5 points: All key use cases are identified with clear descriptions. 2-3 points: Most key use cases were identified, but some were missing or unclear. 0-1 points: Many key use cases are missing or incorrect. Identification of Misuse Cases (7 points) Identifies relevant misuse cases based on the vulnerabilities of OTP systems. 7 points: All major misuse cases identified and correctly linked to vulnerabilities. 2-6 points: Most misuse cases were identified but with minor issues. 0-1 points: Many misuse cases are missing or incorrect. Mitigations (7 points) Provides reasonable and effective mitigations for each identified misuse case. 7 points: Clear and effective mitigations are provided for all misuse cases. 2-6 points: Mitigations are provided for most misuse cases, with some gaps or less effective solutions. 0-1 points: Few or no mitigations provided, or mitigations are ineffective. 5. UML Misuse Case Diagram (6 points) The diagram represents the relationships between actors, use cases, misuse cases, and mitigations logically and accurately. 6 points: The diagram is complete, accurate, and well-organized. Clear representation of use cases, misuse cases, and mitigations. 2-5 points: The diagram is mostly correct but may have minor organizational or accuracy issues. 0-1 points: The diagram is incomplete, confusing, or incorrectly structured.