The HMAC-based one-time password algorithm defined in RFC 4226.
6
votes
1answer
631 views
How does HOTP keep in sync?
My understanding of HOTP is that each password is unique and based on a counter.
$$PASSWORD = HOTP_1(K,C)$$
Where $C$ is an incremental counter.
What I wish to know, is how you keep the client ...
5
votes
2answers
183 views
Why does HOTP use such a complex truncate function?
In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes.
For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
3
votes
2answers
119 views
How is de-synchronisation of HOTP solved?
From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
3
votes
1answer
1k views
What are the advantages of TOTP over HOTP?
HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
2
votes
1answer
112 views
Is it considered insecure in an HOTP implementation to publicly provide the next counter?
I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
1
vote
1answer
118 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
1
vote
0answers
77 views
Storing counter value of HOTP at client side [closed]
How can we store counter value on the client side in HOTP??
