4
$\begingroup$

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong passwords.

Say the user leaves their token with their cat, which decides to generate 200 passwords while rolling around with it. This would likely desynchronise the system such that the user will not be able to login in, even with the look-ahead.

I assume the user would need assistance to reset the system, but what are the actual steps to doing this?

Additionally, what would be a good number for the parameter w? 10? 50? 100?

Improve this question
$\endgroup$
5
$\begingroup$

The usual resynchronization method involves getting several consecutive codes from the token and then running the algorithm once with a very large look-ahead window until the set of consecutive codes are found. The number of consecutive codes needed depends on how far off the token is.

With a typical token, two codes would suffice to handle a desynch of 200. Many HOTP systems will simply ask you for a second code and fix a desynch of less than 500 codes or so by themselves.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Is there any means to DETECT out of synch ? $\endgroup$ – Franklin Jun 3 '12 at 7:27
1
$\begingroup$

As I understand, the user's token normally can't be reset (without destroying it).

So, the assistance would consist in either giving a new token to the user (and declaring the old one invalid), or in stepping the server ahead until it matches again (i.e. running the algorithm once with a really large window size).

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thanks for the RFC edit. Giving out new tokens seems a costly solution. Perhaps it would be better to provide a 're-sync' feature, which runs until the counters match. $\endgroup$ – Jim Dec 17 '11 at 13:39
  • $\begingroup$ Although I can see a situation where people generate OTPs repeatedly when they first get their token, or when they show it to their colleagues/friends :/ $\endgroup$ – Jim Dec 17 '11 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.