0
votes
2answers
50 views

counter to indicate hotp count

I was trying to figure out how HOTP kept from wrapping over, when I saw this explanation of how it works, by Thomas Pornin [source]: The intended scenario is the following: the client has a ...
5
votes
2answers
239 views

Why are HOTP and TOTP implementations all using 6 digits and not more?

I was checking the RFC's after wondering for some time. In RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm, it states on the appendix: A simple enhancement in terms of security would be ...
7
votes
2answers
272 views

Why does HOTP use such a complex truncate function?

In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes. For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
2
votes
1answer
206 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
10
votes
1answer
5k views

What are the advantages of TOTP over HOTP?

HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
1
vote
0answers
94 views

Storing counter value of HOTP at client side [closed]

How can we store counter value on the client side in HOTP??
2
votes
1answer
175 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
3
votes
2answers
191 views

How is de-synchronisation of HOTP solved?

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
11
votes
1answer
1k views

How does HOTP keep in sync?

My understanding of HOTP is that each password is unique and based on a counter. $$PASSWORD = HOTP_1(K,C)$$ Where $C$ is an incremental counter. What I wish to know, is how you keep the client ...