FAQ: What Is the Difference Between an OATH Seed and an OATH Token? – SecureAuth Support

Version Affected: All

Overview

What is the difference between an OATH Seed and an OATH Token, and what does each one store?

Answer

An Authentication Realm is a realm where a user is prompted to log in; in the explanations below, the Authentication Realm is configured for Time-Based One-Time Passcode (TOTP) two-factor authentication (2FA). An Enrollment Realm is a realm designed to enroll users for an OATH Seed or OATH Token, based on the settings on its Post Authentication tab. The resulting OATH Seed or OATH Token is then stored in the linked datastore.

An OATH Seed is just a string value. SecureAuth combines it with the current time and the Authentication Realm's configured passcode length and passcode interval to generate the TOTP value that is matched against what the user enters. You can only have one OATH Seed value at a time — if multiple devices are enrolled with the same seed, they all generate the same TOTP at any given moment.

An OATH Token is an OATH Seed with additional information stored alongside it: the Enrollment Realm's own passcode length and passcode interval. Because an OATH Token carries its own length and interval, SecureAuth can generate its TOTP without relying on the Authentication Realm's length and interval settings at all. This means a user can have multiple, distinct OATH Tokens; enrolling different devices with different OATH Tokens gives each device a different TOTP at any given moment.

This covers only the basics of how each type generates its TOTP value. For more on configuring or using either type, see the SecureAuth documentation site.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.