One-time password (OTP)

Two open algorithms dominate. HOTP (RFC 4226, 2005) computes HMAC-SHA-1 over an 8-byte counter using a shared secret K, then applies dynamic truncation: the low four bits of the last byte of the 20-byte HMAC select an offset, four bytes from that offset are read as a 31-bit integer, and the result modulo 10^d gives a d-digit code (six by default). TOTP (RFC 6238, 2011) replaces the counter with T = floor((Unix time − T0) / X), with T0 = 0 and a time step X of 30 seconds by default, and permits HMAC-SHA-256 and HMAC-SHA-512 as well as SHA-1. Most authenticator apps still use SHA-1, six digits and 30 seconds, which is safe here because HMAC security does not depend on SHA-1 collision resistance.

Verification needs tolerance. HOTP servers use a look-ahead window to resynchronise when a user has pressed the token without logging in; TOTP servers typically accept one time step on either side to allow for clock skew and network delay, and RFC 6238 recommends allowing no more than one step backward. Both need throttling: a six-digit code has only 10^6 values, so without rate limiting an attacker can guess within a validity window, and NIST SP 800-63B requires verifiers to limit consecutive failed attempts. A verifier must also reject reuse of a code that has already been accepted within its window, otherwise a shoulder-surfed or intercepted code can be replayed.

Enrolment is usually a QR code encoding an otpauth:// URI (a de facto format originating with Google Authenticator, not an IETF standard) containing the Base32-encoded secret, issuer, account and parameters. Because the verifier must compute the same HMAC, it stores the secret in recoverable form rather than as a one-way hash; a breach of the seed database compromises every token, as the 2011 attack on RSA's SecurID seeds illustrated. Older schemes include S/KEY (Lamport's hash chain, RFC 1760) and proprietary hardware tokens.

SMS OTP is a different mechanism: the server generates a random code and sends it out-of-band over the telephone network. It inherits that network's weaknesses - SIM-swap fraud, number porting, SS7 interception and malware reading SMS on the device - which is why NIST classifies PSTN delivery as a restricted authenticator. All OTP variants share a structural limitation: the code is a bearer value typed by a human, not bound to the site's origin, so an adversary-in-the-middle phishing page can relay it within its validity window. OTP therefore raises the cost of credential stuffing and password reuse attacks but is not phishing-resistant in the NIST sense, unlike FIDO2/WebAuthn passkeys.