HMAC-based one-time password (HOTP) is a
one-time password
A one-time password (OTP), also known as a one-time PIN, one-time authorization code (OTAC) or dynamic password, is a password that is valid for only one login session or transaction, on a computer system or other digital device. OTPs avoid seve ...
(OTP) algorithm based on
HMAC
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret ...
. It is a cornerstone of the
Initiative for Open Authentication
Initiative for Open Authentication (OATH) is an industry-wide collaboration to develop an open reference architecture using open standards to promote the adoption of strong authentication. It has close to thirty coordinating and contributing memb ...
(OATH).
HOTP was published as an informational
IETF
The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and a ...
RFC 4226 in December 2005, documenting the algorithm along with a Java implementation. Since then, the algorithm has been adopted by many companies worldwide (see below). The HOTP algorithm is a freely available
open standard
An open standard is a standard that is openly accessible and usable by anyone. It is also a prerequisite to use open license, non-discrimination and extensibility. Typically, anybody can participate in the development. There is no single definition ...
.
Algorithm
The HOTP algorithm provides a method of authentication by symmetric generation of human-readable passwords, or ''values'', each used for only one authentication attempt. The one-time property leads directly from the single use of each counter value.
Parties intending to use HOTP must establish some ; typically these are specified by the authenticator, and either accepted or not by the authenticated:
* A
cryptographic hash
A cryptographic hash function (CHF) is a hash algorithm (a map of an arbitrary binary string to a binary string with fixed size of n bits) that has special properties desirable for cryptography:
* the probability of a particular n-bit output ...
method ''H'' (default is
SHA-1
In cryptography, SHA-1 (Secure Hash Algorithm 1) is a cryptographically broken but still widely used hash function which takes an input and produces a 160-bit (20-byte) hash value known as a message digest – typically rendered as 40 hexadecima ...
)
* A
secret key
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key ...
''K'', which is an arbitrary byte string and must remain private
* A
counter
Counter may refer to:
Mathematics and computing
* Counter machine, a subclass of register machines
* Counter (digital), an electronic device, mechanical device, or computer program for counting
* Loop counter, the variable that controls the iter ...
''C'', which counts the number of iterations
* A HOTP value length ''d'' (6–10, default is 6, and 6–8 is recommended)
Both parties compute the HOTP value derived from the secret key ''K'' and the counter ''C''. Then the authenticator checks its locally generated value against the value supplied by the authenticated.
The authenticator and the authenticated increment the counter ''C'' independently of each other, where the latter may increase ahead of the former, thus a resynchronisation protocol is wise. doesn't actually require any such, but does make a recommendation. This simply has the authenticator repeatedly try verification ahead of their counter through a window of size ''s''. The authenticator's counter continues forward of the value at which verification succeeds and requires no actions by the authenticated.
The recommendation is made that persistent throttling of HOTP value verification take place, to address their relatively small size and thus vulnerability to brute-force attacks. It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.
6-digit codes are commonly provided by proprietary hardware tokens from a number of vendors informing the default value of ''d''. Truncation extracts 31
bit
The bit is the most basic unit of information in computing and digital communications. The name is a portmanteau of binary digit. The bit represents a logical state with one of two possible values. These values are most commonly represente ...
s or
decimal digits, meaning that ''d'' can be at most 10, with the 10th digit adding less variation, taking values of 0, 1, and 2 (i.e., 0.3 digits).
After verification, the authenticator can authenticate itself simply by generating the next HOTP value, returning it, and then the authenticated can generate their own HOTP value to verify it. Note that counters are guaranteed to be synchronised at this point in the process.
The ''HOTP value'' is the human-readable design output, a ''d''-digit decimal number (without omission of leading 0s):
: ''HOTP value'' = ''HOTP''(''K'', ''C'') mod 10
''d''.
That is, the value is the ''d'' least significant base-10 digits of HOTP.
''HOTP'' is a truncation of the
HMAC
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret ...
of the counter ''C'' (under the key ''K'' and hash function ''H''):
: ''HOTP''(''K'', ''C'') = truncate(HMAC(''K'', ''C'')),
where the counter ''C'' must be used
big-endian
In computing, endianness, also known as byte sex, is the order or sequence of bytes of a word of digital data in computer memory. Endianness is primarily expressed as big-endian (BE) or little-endian (LE). A big-endian system stores the most sig ...
.
Truncation first takes the 4 least significant bits of the ''MAC'' and uses them as a byte offset ''i'':
: truncate(''MAC'') = extract31(''MAC'', ''MAC''
19 × 8 + 4):(19 × 8 + 7),
where ":" is used to extract bits from a starting bit number up to and including an ending bit number, where these bit numbers are 0-origin. The use of "19" in the above formula relates to the size of the output from the hash function. With the default of SHA-1, the output is , and so the last byte is byte 19 (0-origin).
That index ''i'' is used to select 31 bits from ''MAC'', starting at bit ''i'' × 8 + 1:
: extract31(''MAC'', ''i'') = ''MAC''
''i'' × 8 + 1):(''i'' × 8 + 4 × 8 − 1)
31 bits are a single bit short of a 4-byte word. Thus the value can be placed inside such a word without using the sign bit (the most significant bit). This is done to definitely avoid doing modular arithmetic on negative numbers, as this has many differing definitions and implementations.
Tokens
Both hardware and software tokens are available from various vendors, for some of them see references below. Hardware tokens implementing OATH HOTP tend to be significantly cheaper than their competitors based on proprietary algorithms.
As of 2010, OATH HOTP hardware tokens can be purchased for a marginal price. Some products can be used for strong passwords as well as OATH HOTP.
Software tokens are available for (nearly) all major mobile/
smartphone
A smartphone is a portable computer device that combines mobile telephone and computing functions into one unit. They are distinguished from feature phones by their stronger hardware capabilities and extensive mobile operating systems, whic ...
platforms (
J2ME
Java Platform, Micro Edition or Java ME is a computing platform for development and deployment of portable code for embedded and mobile devices (micro-controllers, sensors, gateways, mobile phones, personal digital assistants, TV set-top ...
,
Android,
iPhone,
BlackBerry
The blackberry is an edible fruit produced by many species in the genus ''Rubus'' in the family Rosaceae, hybrids among these species within the subgenus ''Rubus'', and hybrids between the subgenera ''Rubus'' and ''Idaeobatus''. The taxonomy of ...
,
Maemo
Maemo is a software platform originally developed by Nokia, now developed by the community, for smartphones and Internet tablets. The platform comprises both the Maemo operating system and SDK. Maemo played a key role in Nokia's strategy to com ...
,
macOS
macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...
, and
Windows Mobile
Windows Mobile is a discontinued family of mobile operating systems developed by Microsoft for smartphones and personal digital assistants.
Its origin dated back to Windows CE in 1996, though Windows Mobile itself first appeared in 2000 as Pock ...
).
Reception
Although the reception from some of the computer press has been negative during 2004 and 2005,
after IETF adopted HOTP as RFC 4226 in December 2005, various vendors started to produce HOTP-compatible tokens and/or whole authentication solutions.
According to the article "Road Map: Replacing Passwords with OTP Authentication"
on strong authentication, published by Burton Group (a division of
Gartner, Inc.
Gartner, Inc is a technological research and consulting firm based in Stamford, Connecticut that conducts research on technology and shares this research both through private consulting as well as executive programs and conferences. Its client ...
) in 2010, "
Gartner
Gartner, Inc is a technological research and consulting firm based in Stamford, Connecticut that conducts research on technology and shares this research both through private consulting as well as executive programs and conferences. Its clients ...
's expectation is that the hardware
OTP form factor will continue to enjoy modest growth while
smartphone
A smartphone is a portable computer device that combines mobile telephone and computing functions into one unit. They are distinguished from feature phones by their stronger hardware capabilities and extensive mobile operating systems, whic ...
OTPs will grow and become the default hardware platform over time."
See also
*
Initiative for Open Authentication
Initiative for Open Authentication (OATH) is an industry-wide collaboration to develop an open reference architecture using open standards to promote the adoption of strong authentication. It has close to thirty coordinating and contributing memb ...
*
S/KEY S/KEY is a one-time password system developed for authentication to Unix-like operating systems, especially from dumb terminals or untrusted public computers on which one does not want to type a long-term password. A user's real password is combined ...
*
Time-based one-time password algorithm
Time-based one-time password (TOTP) is a computer algorithm that generates a one-time password (OTP) that uses the current time as a source of uniqueness. As an extension of the HMAC-based one-time password algorithm (HOTP), it has been adopted a ...
(TOTP)
References
{{refs
External links
RFC 4226: HOTP: An HMAC-Based One-Time Password AlgorithmRFC 6238: TOTP: Time-Based One-Time Password AlgorithmRFC 6287: OCRA: OATH Challenge-Response AlgorithmInitiative For Open AuthenticationImplementation of RFC 4226 - HOPT AlgorithmStep by step Python implementation in a
Jupyter Notebook
Project Jupyter () is a project with goals to develop open-source software, open standards, and services for interactive computing across multiple programming languages. It was spun off from IPython in 2014 by Fernando Pérez and Brian Granger ...
Internet protocols
Cryptographic algorithms
Computer access control protocols