# OTP Scheme where only one party can generate the OTP, but both parties can verify it's validity

As far as I understand, OTP usually works on a superficial layer by having two parties both know of a key and then authenticate each other by sharing a hash of the key and some sort of counter (e.g. currentTime mod someNumber) with each other. In theory, this means both parties can verify each other, as both have the capabilty to generate a OTP and both have the the capability to verify the integrity OTP given to them.

I'm looking for an OTP scheme between two parties where both parties can verify the validity of an OTP, but only one party can generate it. To my understanding, this would not work with the logic described above. Does such a protocol already exist? If not, is such a system even mathematically realizable?

• Welcome to Cryptography. The OTP key can be generated by the one party, however, the distribution must be performed physically. OTP is malleable i.e. one can modify the content on the way or it is due to a transmission error. Your main question is how to prevent this so that OPT messages have an integrity? Jun 15 '20 at 12:32
• @kelalaka: actually, you could have integrity guarantees with an OTP (by using a universal hash keyed by some bits from the OTP pad). However, I don't think that's what Nicolas is asking... Jun 15 '20 at 12:35
• @poncho yes, one can use the keystream to use in keyed hash functions. If OP asking one party generates then the problem is how it is distributed. Jun 15 '20 at 14:06
• Nicolas, where do you get this definition of OTP? The elements you describe are not all part of a basic OTP. Jun 16 '20 at 3:38
• I think OP is talking about one time passwords, not one time pads. It was even tagged as such until @kelalaka removed the tag. Why did you do that? Jun 16 '20 at 10:17

If Alice and Bob need to do this $$n$$ times based on the same exchanged key, then what Alice can do is select the base key, and hash that $$n$$ times, that is, compute $$H^n(\text{base key}) = \underbrace {H(H(H(…H(\text{base key})))))}_{n \text{ times}}$$, and send that to Bob. Then, to authenticate the first time, she would send $$H^{n-1}(\text{base key})$$, which Bob can verify with his copy of the base key (but could not compute beforehand). To authenticate the second time, she would send $$H^{n-2}(\text{base key})$$, and keep on doing this up to $$n$$ times.