Replay resistance in Symantec VIP
Article ID: 445708
Updated On:
Products
Issue/Introduction
Symantec VIP uses time-based One-Time Passwords (TOTP) to provide replay-resistant authentication. This article describes how to configure validation windows to maintain high security against replay attacks.
Environment
- Symantec VIP Service
- VIP Manager
- VIP Enterprise Gateway 9.11 and later
Resolution
Symantec VIP is designed to be replay-resistant through the use of time-based One-Time Passwords (TOTP).
Because these codes are cryptographically bound to a specific time interval, a captured code cannot be used once that window has passed or the code has been successfully used by the validation service.
You can check and configure the credential time window within the VIP Manager Credential Security Settings:
- Log in to the VIP Manager console.
- Navigate to the Account tab and select Credential Security Settings from the left-hand menu.
- Locate the HOTP Time based section. This area manages the validation "windows" (typically 30-second increments) that account for clock drift between a user's device and the VIP backend.
- By clicking Change settings and selecting Set Manually, you can observe the current window. A lower value here ensures a stricter (and more replay-resistant) validation period.
Additionally, if using the VIP Enterprise Gateway, ensure the running version is 9.11 or later, as this version includes specific security enhancements for the management console's resistance to replay-style attacks (CSRF).
Additional Information
Feedback
