Here is my use case:
A user is trying to transfer money to his friend's account. He enters transaction details on banking website. Bank receives it and then Bank sends transaction details (receiver name and amount) + One Time Password back to the user (may be through different channel : mobile) so that user can verify the transaction details (this is to ensure transaction integrity. ie., no man-in-the-middle attack) and enter the OTP to confirm the transaction.
What is the threat model?
Man-in-the-middle attack. If an attacker (in middle) modifies the receiver's bank account details with attacker controlled bank account but shows fake transaction summary, the OTP that sent along with the transaction details should become invalid.
What OTP generation algorithm should I use?
someOTPgenAlgo(transaction details) = OTP.
Now if the attacker changes the receiver bank account details, he also has to find the matching OTP for that modified transaction details Which should be impossible. How do I achieve this? Is following enough ?
someOTPgenALgo(transaction details + some random key ) = OTP
Thanks a lot. Sorry if the question is naive, I am pretty clueless about this