Oakland Multi-Factor Authentication Implementation Plan - One Time Password

Objective

Integrate an email-based Multi-Factor Authentication (MFA) system into the existing login process to enhance security.

---

1. Project Scope

1. Users Involved:
   • All users with access to the system.
   • Administrators and developers for implementation and monitoring.

2. Key Features:
   • One-time passcode (OTP) delivery via email.
   • OTP expiration and validation.
   • Fallback mechanisms for OTP resend.

---

2. Requirements

Technical Requirements

1. Frontend:
   • A page to prompt for the OTP after a successful login.
   • Error messages for invalid or expired OTPs.

2. Backend:
   • Mechanism to generate, store, and validate OTPs.
   • Integration with an email-sending library or service.

3. Database:
   • Table for temporarily storing OTPs and expiration timestamps.

4. Security:
   • OTP expiration within 5 minutes.
   • Protection against brute force attacks with rate limiting.

Infrastructure Requirements

• SMTP server for email delivery (e.g., SendGrid, Postmark, or in-house SMTP server).

• Secure environment for storing secrets (e.g., API keys for the SMTP server).

---

3. Steps to Implement

Phase 1: Preparation

1. Identify users who will be part of the MFA rollout.

2. Select or configure an email-sending service (e.g., PHPMailer, AWS SES, or SendGrid).

3. Design and prepare database schema for OTP storage:

sql
Copy code
CREATE TABLE mfa_tokens (
    user_id INT NOT NULL,
    otp VARCHAR(6) NOT NULL,
    expires_at DATETIME NOT NULL,
    PRIMARY KEY (user_id)
);

---

Phase 2: Development

Frontend Development

1. Create a new screen or modal for OTP input.
   • Fields: OTP input, "Resend Code" button.
   • Error display for invalid or expired OTPs.

2. Add transitions between login and MFA input pages.

Backend Development

1. Generate OTP:
   • Implement an OTP generator function.

php
Copy code
function generateOTP($length = 6) {
    return str_pad(random_int(0, pow(10, $length) - 1), $length, '0', STR_PAD_LEFT);
}

2. Send Email with OTP:
   • Use an email-sending library to deliver the OTP.

php
Copy code
use PHPMailer\PHPMailer\PHPMailer;
// Function to send OTP

3. Store OTP:
   • Save the OTP and expiration timestamp in the database.

php
Copy code
$expiresAt = date('Y-m-d H:i:s', strtotime('+5 minutes'));

4. Validate OTP:
   • Retrieve the OTP from the database and check against user input.
   • Invalidate OTP after it is used or expires.

5. Handle Resend Requests:
   • Allow users to request a new OTP with the same process as the initial email.

Security Measures

• Hash the OTP in the database using password_hash() for security.

• Implement rate-limiting to prevent brute force attacks on the OTP entry form.

---

Phase 3: Testing

1. Unit Testing:
   • Test OTP generation, storage, and validation functions.

2. Integration Testing:
   • Test end-to-end login and MFA flow.
   • Verify email delivery and content.

3. User Testing:
   • Select a group of users for beta testing to gather feedback.

4. Security Testing:
   • Test the system against common attacks (e.g., brute force, token replay).

---

Phase 4: Deployment

1. Deploy changes to a staging environment for final testing.

2. Train support staff to assist users with the MFA process.

3. Roll out the feature incrementally (e.g., start with admins, then extend to all users).

---

Phase 5: Monitoring and Maintenance

1. Monitor logs for MFA errors and user feedback.

2. Set up alerts for failed login attempts.

3. Regularly review security and usability.

4. Plan periodic updates to improve the system based on user feedback.

---

4. Timeline

Task	Estimated Time
Preparation and planning	2 days
Frontend development	3 days
Backend development	5 days
Testing	3 days
Deployment and monitoring	2 days
Total	15 days

---

5. Risks and Mitigations

Risk	Mitigation
Email delivery delays	Use a reliable SMTP service and monitor delivery.
OTP brute force attacks	Implement rate limiting and logging.
Users forgetting to check their email	Provide clear instructions in the UI.
Failure to store OTPs securely	Hash OTPs and use HTTPS for all communication.

---