A one-time password (OTP) algorithm based on the hash-based message authentication code (HMAC) cryptographic algorithm, HOTP is a basis for the commonly used Time-based one-time password (TOTP) algorithm. The HOTP algorithm is a freely available open standard and often forms part of multi-factor authentication protocols such as the Open Authentication initiative (OATH) challenge-response algorithm. At setup time a client and server share a secret and other initialization settings. In future exchanges when a client attempts to access a server a challenge is sent from the server to the client and the client then uses the previously exchanged secret and computes a value (a one time password) to be used as the server's challenge response.
Algorithm and Function
HOTP uses a cryptographic hash function (usually HMAC-SHA1) and a shared secret key to generate a unique password based on a counter value. The HMAC function takes the shared secret key and the counter value as inputs and generates a fixed-length output. A portion of this output is then converted into a 6-8 digit decimal number, which serves as the one-time password.
- Shared secret: The server and the user's device share a secret key, which is used along with the counter value to generate the same password independently.
- Counter-based: Each password is generated using a counter that increments after each use. The server and the user's device keep track of the counter independently.
Synchronization and Security
The server and the user's device must maintain a synchronized counter for the system to work correctly. If the counters become out of sync, the generated passwords will not match. The main difference between HOTP and TOTP is that HOTP uses a counter value, while TOTP uses the current time to generate passwords. TOTP is generally considered more secure and convenient, as it does not require the server and the user's device to keep track of the counter state.
Applications
HOTP is defined in RFC 4226 and is used in various authentication systems, including hardware tokens and software-based authenticator apps. It serves as a foundational technology for more advanced OTP systems like TOTP.