OTP, SMS, and Authenticator Apps
When cryptographic intent is signed directly, time-based codes and shared secrets become unnecessary.
Legacy OTP Model vs PTERI
| Category | Traditional Model | Problems | PTERI Replacement |
|---|---|---|---|
| Authentication Method | Time-based codes (TOTP/SMS OTP) | Code replay | Explicit cryptographic approval |
| Secret Model | Shared seeds between server and device | Shared secrets can be extracted or duplicated | No shared seeds |
| Telecom Dependency | SMS-based verification | SIM swap attacks | No telecom dependency |
| Session Authorization | Code proves temporary access | Does not prove specific intent | Single-use cryptographic challenges |
| User Experience | Manual code entry | UX friction, added failure modes | Local biometric gating |
| Security Model | One-time code validates login | Codes can be phished and reused within window | Intent is signed and bound to challenge |
Core Principle
"OTP becomes unnecessary when intent is signed."
When approval is cryptographic, explicit, and single-use, time-based codes add no security value.