Multiotp

Abstract

1. Introduction

multiOTP open source multiOTP open source is a GNU LGPL implementation of a strong two-factor authentication PHP class multiOTP open source is OATH certified for HOTP/TOTP

(c) 2010-2026 SysCo systemes de communication sa https://www.multiotp.net/

Docker container available: docker run -v path/to/multiotp/data:/etc/multiotp -v path/to/freeradius/config:/etc/freeradius -v path/to/multiotp/log:/var/log/multiotp -v path/to/freeradius/log:/var/log/freeradius -p 80:80 -p 443:443 -p 1812:1812/udp -p 1813:1813/udp -d multiotp/multiotp-open-source

2. Objective

multiOTP open source strong two factor authentication PHP library, OATH certified, with TOTP, HOTP, Mobile-OTP, YubiKey, SMS, QRcode provisioning, etc.

This project demonstrates how PHP can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

• Any tokens that are OATH certified
• Feitian provides OATH compliant HOTP and TOTP tokens
• OTP c100: OATH/HOTP, 6 digits
• OTP c200: OATH/TOTP, 6 digits, 60 seconds time interval
• Gemalto provides OATH compliant HOTP and TOTP tokens
• Gemalto Ezio Token
• Seamoon provides OATH compliant TOTP tokens
• Seamoon KingKey: OATH/TOTP, 6 digits, 60 seconds time interval

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• PHP 7.4+ with a web server (XAMPP / WAMP / LAMP)
• MySQL / MariaDB
• phpMyAdmin (optional)
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/multiOTP/multiotp.git
cd multiotp

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by multiOTP and published on GitHub under the GNU Lesser General Public License v3.0. Please follow the license terms and credit the original author when you use or modify this code.