I'm trying to create a sort of Time-based One Time Password (TOTP) where machines are involved (not humans). In this kind of TOTP the step is 15 minutes between one code to the next one and both server and client share the same 256 bit secret key (k). The message (m) is the current unix timestamp that is known by an attacker so suppose the text plain message m is known. The key k is always the same and the attacker also knows the algorithm used for cryptography.
I think about two possible solutions for this problem:
- HMAC(k,m) using sha256 as base algorithm client side, send the result and check server side that the hash is the same, then ok.
- AES(k,m) and send crypted message as base 64 to the server. The server decrypt the message and check the time. If the time is included in accepted range then ok.
An attacker knows the plain text (time) and the crypted message (that can be the HMAC hashed text for option 1 or the crypted text after AES for option 2) and have maybe 500 possible combination of textplain plus related encrypted text.
Q1: is it possible for the attacker to know the key k before a time range of 5 years for both of options with current computational power?
Q2: Which is the most secure option to use? Option 1 or option 2?
I'm studying these algorithms for days but I haven't find an answer to my questions yet.
Note: I studied TOTP in RFC 6238 too but it seems more related to Machine-human than machine-machine TOTP. For machines, with a 15 minutes step, seems more insecure than the 2 options proposed.
Thanks for everyone can help me in these questions, are making me crazy.