How is synchronization of counter values achieved in the HOTP protocol?

As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at client side?

Suppose server verifies 50 successful attempts from client which implies counter value at server is 50. What if a fresh request comes from a different client with counter value 0? The server could only check for counter values 50,51,52 if window size is 3,or 50-100 if window size is 50. In both the cases there will be no match as client side counter value is 0.


1 Answer 1


There is no "fresh client" with HOTP. The whole counter business is based on the idea that there is a single client, who maintains his counter which is more-or-less synchronized with the server counter. The synchronization window is just a way to cope with small unsynchronization events which come from realistic situations (e.g. your 3-year-old played with your car keys and pushed the "unlock button" a few dozen times).

If you want several clients, each client has his own counter, and the server must maintain one counter per client.

  • 1
    $\begingroup$ Also, each client would have its own (secret) key, so the clients don't generate the same sequence. $\endgroup$ Feb 27, 2012 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.