Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong passwords.

Say the user leaves their token with their cat, which decides to generate 200 passwords while rolling around with it. This would likely desynchronise the system such that the user will not be able to login in, even with the look-ahead.

I assume the user would need assistance to reset the system, but what are the actual steps to doing this?

Additionally, what would be a good number for the parameter w? 10? 50? 100?

share|improve this question
add comment

2 Answers

The usual resynchronization method involves getting several consecutive codes from the token and then running the algorithm once with a very large look-ahead window until the set of consecutive codes are found. The number of consecutive codes needed depends on how far off the token is.

With a typical token, two codes would suffice to handle a desynch of 200. Many HOTP systems will simply ask you for a second code and fix a desynch of less than 500 codes or so by themselves.

share|improve this answer
    
Is there any means to DETECT out of synch ? –  Franklin Jun 3 '12 at 7:27
add comment

As I understand, the user's token normally can't be reset (without destroying it).

So, the assistance would consist in either giving a new token to the user (and declaring the old one invalid), or in stepping the server ahead until it matches again (i.e. running the algorithm once with a really large window size).

share|improve this answer
    
Thanks for the RFC edit. Giving out new tokens seems a costly solution. Perhaps it would be better to provide a 're-sync' feature, which runs until the counters match. –  Jim Dec 17 '11 at 13:39
    
Although I can see a situation where people generate OTPs repeatedly when they first get their token, or when they show it to their colleagues/friends :/ –  Jim Dec 17 '11 at 13:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.