[ARCHIVE] One Time Password Expiry

Archived 2023.01.11. Content moved to Guidance for One Time Password (OTP)

Question

In the specifications, some aspects of OTP (One Time Password) are specified, and some are not. For example, the length of 4 to 6 digits is specified. However expiry of the OTP is not specified.

The provided OTP must be invalidated after a period of time at the discretion of the Data Holder. This expiry period should provide time for the customer to reasonably complete the authorisation process

There is an upper limit on the expiration period. For example 24 hours would be a very long duration for the OTP to be valid.

From a CX (Consumer Experience) perspective, would a consumer be alarmed if they see an OTP valid for 24 hours?

From a security perspective, keeping the validity of OTP to a short period would always be a good idea and reduces risk.

Is it appropriate to standardise on a reasonable upper limit  such as 10 or 15 minutes?

Answer

In general, our preference is not to be specific with the standards unless there is a need for specificity. 

We are expecting Data Holders to select a reasonable expiry timeframe. So far the Data Holders that have implemented have used sensible expiry times for their OTPs.

If Data Holders start adopting long expiry times for OTPs then we are likely to look at being specific in this part of the standards.

See:

• CDS Authentication Standards
• CDS OIDC Hybrid Flow