Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part,

The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP value HOTP client. If the value received by the authentication server matches the value calculated by the client, then the HOTP value is validated.

I don't understand this. Doesn't the client send the value it calculated to the authentication server? Thus, wouldn't "the value received by the authentication server matches the value calculated by the client" always be true?

What I am misunderstanding here?

share|improve this question
4  
I think I agree with you: it looks like the clause should be “if the value calculated by the authentication server matches the value calculated by the client” or “if the value received by the authentication server matches the value calculated by the server”, and similarly in the next paragraph. –  Gilles Aug 6 '13 at 15:12

1 Answer 1

I agree that Gilles' interpretation in the comments is the only one that makes sense; the RFC clearly contains an editorial error, and should read either (emphasis indicates corrections):

"If the value calculated by the authentication server matches the value calculated by the client, then the HOTP value is validated."

or:

"If the value received by the authentication server matches the value calculated by the server, then the HOTP value is validated."

The first sentence in your quote isn't grammatical anyway: the words "HOTP client" appear to have been randomly and meaninglessly appended to it, perhaps as a result of careless copy-pasting.

The IETF has a whole bunch of errata for RFC 4226, but this particular mistake doesn't appear to be listed there. You might want to report it yourself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.