How HOTP values are validated according to RFC 4226

Question

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part,

The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP value HOTP client. If the value received by the authentication server matches the value calculated by the client, then the HOTP value is validated.

I don't understand this. Doesn't the client send the value it calculated to the authentication server? Thus, wouldn't "the value received by the authentication server matches the value calculated by the client" always be true?

What I am misunderstanding here?

Answer 1

I agree that Gilles' interpretation in the comments is the only one that makes sense; the RFC clearly contains an editorial error, and should read either (emphasis indicates corrections):

"If the value calculated by the authentication server matches the value calculated by the client, then the HOTP value is validated."

or:

"If the value received by the authentication server matches the value calculated by the server, then the HOTP value is validated."

The first sentence in your quote isn't grammatical anyway: the words "HOTP client" appear to have been randomly and meaninglessly appended to it, perhaps as a result of careless copy-pasting.

The IETF has a whole bunch of errata for RFC 4226, but this particular mistake doesn't appear to be listed there. You might want to report it yourself.