Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical computation such as HOTP and S/Key.

The problem is they do not depend on some parameters to generate OTP.

What I would like to know is which one I can use to generate OTP using hash function and some session tokens (IP address, etc.). These tokens will be used as parameters of the hash function. Of course, I would prefer options that are secure and hard to break.

share|improve this question
1  
Hum, could be easier if instead of saying the solution you're considering, you tell us what is your problem and then the solution you're thiking about, and problems you have with it... –  woliveirajr Feb 24 '12 at 15:32
add comment

1 Answer

It sounds like you're trying to improve the security of OTP schemes by adding extra "random-ish" data. My answer will address that, please update your question if that is a wrong interpretation.

These schemes don't literally have multiple inputs that you could feed this extra data into, but you don't need them to. For example, with HOTP the security of the function lies in the secret key. If it's strong, you have nothing to gain by incorporating outside data like IP addresses that are neither random nor private.

It sounds like the problem is that you don't trust the key to be secure and you want to augment the security by throwing in a variety of other factors. But instead, just focus on generating a good key. Instead of having your OTP scheme take input from a variety of sources, you should have your key generation take input from a variety of entropy sources. All of your entropy, which might include things like network addresses, is then mixed together in one step, used to generate a key in another step, and then the key is finally plugged into an existing OTP scheme. Then your OTPs will be dependent on some of the data that you mention here.

share|improve this answer
    
your comment is amazing. It is really helpful and that is exactly what I want to reach. I really appreciate your help. Thank you very much. –  MR.NASS Feb 24 '12 at 18:43
1  
Excellent, glad it helped. Please upvote helpful answers. :-) –  B-Con Feb 26 '12 at 0:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.