View source for HMAC-based One-time Password algorithm

{{short description|Password authentication algorithm}}
'''HMAC-based One-time Password algorithm (HOTP)''' is a [[One-time password|one-time password]] (OTP) algorithm based on ''hash-based message authentication codes'' (HMAC). It is a cornerstone of the [[Initiative for Open Authentication]] (OATH).

HOTP was published as an informational [[IETF]] RFC 4226 in December 2005, documenting the algorithm along with a Java implementation. Since then, the algorithm has been adopted by many companies worldwide (see below). The HOTP algorithm is a freely available [[Engineering:Open standard|open standard]].

==Algorithm==
The HOTP algorithm provides a method of authentication by symmetric generation of human-readable passwords, or ''values'', each used for only one authentication attempt. The one-time property leads directly from the single use of each counter value.

Parties intending to use HOTP must establish some {{vanchor|parameters}}; typically these are specified by the authenticator, and either accepted or not by the authenticated:
* A [[Cryptographic hash function|cryptographic hash]] method, H (default is [[SHA-1]])
* A secret key, ''K'', which is an arbitrary byte string, and must remain private
* A counter, ''C'', which counts the number of iterations 
* A HOTP{{thinsp}}value length, ''d'' (6–10, default is 6, and 6–8 is recommended)

Both parties compute the HOTP{{thinsp}}value derived from the secret key ''K'' and the counter ''C''. Then the authenticator checks its locally-generated value against the value supplied by the authenticated.

The authenticator and the authenticated increment the counter, ''C'', independently of each other, where the latter may increase ahead of the former, thus a resynchronisation protocol is wise. RFC{{nbsp}}4226 doesn't actually require any such, but does make a recommendation. This simply has the authenticator repeatedly try verification ahead of their counter through a window of size, ''s''. The authenticator's counter continues forward of the value at which verification succeeds, and requires no actions by the authenticated.

The recommendation is made that persistent throttling of HOTP{{thinsp}}value verification take place, to address their relatively small size and thus vulnerability to brute force attacks. It is suggested that verification be locked out after a small number of failed attempts, or that each failed attempt attracts an additional (linearly-increasing) delay.

6-digit codes are commonly provided by proprietary hardware tokens from a number of vendors informing the default value of ''d''. Truncation extracts 31 bits or <math display="inline">\log_{10}\left(2^{31}\right)</math> ≈ 9.3 decimal digits, meaning, at most, ''d'' can be 10, with the 10th digit providing less extra variation, taking values of 0, 1, and 2 (i.e., 0.3 digits).

=== Bidirectional authentication ===
After verification, the authenticator can authenticate itself simply by generating the next HOTP{{thinsp}}value, returning it, and then the authenticated can generate their own HOTP{{thinsp}}value to verify it. Note that counters are guaranteed to be synchronised at this point in the process.

===HOTP{{thinsp}}value===
The '''HOTP{{thinsp}}value''' is the human-readable design output, a ''d''-digit decimal number (without omission of leading 0s):
: '''HOTP{{thinsp}}value''' = '''HOTP'''(''K'', ''C'') mod 10<sup>''d''</sup>

That is, the value is the ''d'' least significant base-10 digits of HOTP.

'''HOTP''' is a truncation of the hash-based message authentication code (HMAC) of the counter, ''C'' (under the key, ''K'', and hash function, H).
: '''HOTP'''(''K'', ''C'') = truncate(HMAC{{sub|H}}(''K'', ''C''))

Truncation first takes the 4 least significant bits of the ''MAC'' and uses them as an offset, ''i''.
: truncate(''MAC'') = extract31(''MAC'', ''MAC''[(19 × 8) + 4:(19 × 8) + 7] × 8)

That index ''i'' is used to select 31 bits from ''MAC'', starting at bit ''i + 1''.
: extract31(''MAC'', ''i'') = ''MAC''[''i'' + 1:''i'' + (4 × 8) − 1]

Note that 31 bits is a single bit short of a 4-byte word. Thus, the value can be placed inside such a word without using the sign bit (the most significant bit). This is done to definitely avoid doing modular arithmetic on negative numbers, as this has many differing definitions and implementations.<ref>
{{cite web
 | url=https://tools.ietf.org/html/rfc4226#section-5.3
 | title=HOTP: An HMAC-Based One-Time Password Algorithm
 | first1=Hoornaert | last1=Frank
 | first2=Naccache  | last2=David
 | first3=Bellare   | last3=Mihir
 | first4=Ranen     | last4=Ohad
 | website=tools.ietf.org
}}</ref>

==Tokens==
Both hardware and software tokens are available from various vendors, for some of them see references below. Hardware tokens implementing OATH HOTP tend to be significantly cheaper than their competitors based on proprietary algorithms.<ref name="gartnerotprm">{{cite web
 | work = Burton Group | year = 2010
 | first = Mark | last = Diodati
 | title = Road Map: Replacing Passwords with OTP Authentication
 | url = http://www.burtongroup.com/Research/PublicDocument.aspx?cid=2107
 | quote = [[Company:Gartner|Gartner]]'s expectation is that the hardware [[One-time password|OTP]] form factor will continue to enjoy modest growth while [[Engineering:Smartphone|smartphone]] OTPs will grow and become the default hardware platform over time. ...  If the organization does not need the extensive platform support, then OATH-based technology is likely a more cost-effective choice.
}}</ref> As of 2010, OATH HOTP hardware tokens can be purchased for a marginal price.<ref>{{cite web
 | work = Entrust | year = 2011
 | title = Security Authentication Tokens - Entrust
 | url = http://www.entrust.com/strong-authentication/identityguard/tokens/
 | quote = Priced at $5 per token, the Entrust IdentityGuard Mini Token demonstrates that secure, reliable hardware authentication can be had at an attractive price. ... OATH and DES/3DES algorithm support  
}}</ref> Some products can be used for strong passwords as well as OATH HOTP.<ref>{{cite web
| work = Smart Crib | year = 2013
| title = Password sCrib Tokens - Smart Crib
| url = http://www.s-crib.com/s-crib/ | archive-url = https://web.archive.org/web/20130320113344/http://www.s-crib.com/s-crib/ | url-status = dead | archive-date = 2013-03-20 | quote = You can get a token typing 4 updatable passwords and 8 digit OATH HOTP codes for the price of £35, no strings attached.
}}</ref>

Software tokens are available for (nearly) all major mobile/[[Engineering:Smartphone|smartphone]] platforms (J2ME,<ref>{{cite web
 |work        = Data Security Systems Solutions
 |date        = 2006-02-24
 |title       = DS3 Launches OathToken Midlet Application
 |url         = http://ds3global.com/index.php/en/news-a-events/news/97-securing-data-delivery-hassle-free-/
 |quote       = Singapore, Friday, 24 February 2006 - Data Security Systems Solutions is pleased to announce the launch of OathToken Midlet application, an extension of DS3 flagship product - Authentication Server.
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20131229080741/http://ds3global.com/index.php/en/news-a-events/news/97-securing-data-delivery-hassle-free-
 |archive-date = 29 December 2013
 |df          = 
}}
</ref> [[Software:Android (operating system)|Android]],<ref>{{cite web
 | work = diamondz... AT googlemail.com  (not a full address, no better info on author could be found) | year = 2009
 | title = Android Token
 | url = http://code.google.com/p/androidtoken/
 | quote = Android Token is a project to create OATH software tokens for the Android platform. Turning a mobile phone into a One Time Password (OTP) generation device which can be used in the place of hardware tokens. ... The project supports both HOTP (Event Tokens) and TOTP (Time Tokens) specifications. ... Code license: GNU GPL v3
}}
</ref><ref>{{cite web
 |work        = StrongAuth
 |year        = 2010
 |title       = StrongAuth
 |url         = http://www.androidzoom.com/android_applications/tools/strongauth_bmeq.html
 |quote       = Time-based one-time passcode generator based on HOTP (RFC 4226).
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20100518213222/http://www.androidzoom.com/android_applications/tools/strongauth_bmeq.html
 |archive-date = 2010-05-18
 |df          = 
}}
</ref> [[Engineering:IPhone|iPhone]],<ref>{{cite web
 | work = Archie L. Cobbs | year = 2010
 | first = Archie L. | last= Cobbs
 | title = OATH Token
 | url = http://code.google.com/p/oathtoken/
 | quote = OATH Token is a free and open-source software token for two-factor authentication on the iPhone. OATH Token implements the RFC 4226 HOTP/OATH algorithm standard and is not tied to any proprietary server software. 
}}
</ref> [[Engineering:BlackBerry|BlackBerry]],<ref name="actividentityst">{{cite web
 |work        = ActivIdentity
 |year        = 2010
 |title       = ActivIdentity Soft Tokens
 |url         = http://www.actividentity.com/products/authenticationdevices/SoftTokens/
 |quote       = All ActivIdentity Soft Tokens support the Initiative For Open Authentication (OATH) HMAC-Based One-Time Password (HOTP) algorithm. ... ActivIdentity Mobile Soft Tokens are available on leading handset operating systems, including BlackBerry®, Apple® iPhone®, Windows Mobile, and many other Java 2 Platform, Micro Edition (J2ME) enabled devices.
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20100917040954/http://actividentity.com/products/authenticationdevices/SoftTokens/
 |archive-date = 2010-09-17
 |df          = 
}}
</ref> [[Software:Maemo|Maemo]],<ref>{{cite web
 | work = Sean Whitbeck | year = 2011
 | first = Sean | last = Whitbeck
 | title = OTP Generator for N900
 | url = http://maemo.org/packages/view/otp/
 | quote = OTP Generator for Maemo on the Nokia N900. Supports OATH tokens (HOTP,TOTP) as well as the Mobile-OTP algorithm.
}}
</ref> [[Software:MacOS|macOS]],<ref>{{cite web
 |work        = Feel Good Software
 |year        = 2011
 |title       = SecuriToken
 |url         = http://www.feelgoodsoftware.com/
 |quote       = SecuriToken is an RFC compliant application to create and manage multiple software tokens for the OS X platform. Turning your Mac into a One Time Password (OTP) generation device which can be used in the place of hardware tokens.
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20120425125135/http://www.feelgoodsoftware.com/
 |archive-date = 2012-04-25
 |df          = 
}}
</ref> and [[Software:Windows Mobile|Windows Mobile]]<ref name="actividentityst"/>).

==Reception==
Although the reception from some of the computer press has been negative during 2004 and 2005,<ref>{{cite web
 | work = Network World | date = 2004-12-06
 | first = Dave | last = Kearns
 | title = Digging deeper into OATH doesn't look so good
 | url = http://www.networkworld.com/newsletters/dir/2004/1206id1.html
 | quote = It may be that OATH will amount to something someday, but so far, it appears to be a stalking horse for VeriSign and that's not a bandwagon we should thoughtlessly jump on.
}}</ref><ref>{{cite web
 | work = Computerworld | date = 2005-03-21
 | first = Mark | last = Willoughby
 | title = No agreement on Oath authentication
 | url = http://www.computerworld.com/s/article/99273/No_agreement_on_Oath_authentication
}}</ref><ref>{{cite web
 | work = Computerworld
 | first = Burt | last = Kaliski | date = 2005-05-19
 | title = Algorithm agility and OATH
 | url = http://www.computerworld.com/s/article/101788/Algorithm_agility_and_OATH
 | quote = Nevertheless, there is still good reason to question whether HOTP is suitable as a standard algorithm for OTP generation, and, more generally, whether such a standard algorithm is even necessary at all.
}}</ref> after IETF adopted HOTP as RFC 4226 in December 2005, various vendors started to produce HOTP compatible tokens and/or whole authentication solutions.

According to a paper on strong authentication (entitled "Road Map: Replacing Passwords with OTP Authentication") published by Burton Group (a division of [[Company:Gartner|Gartner, Inc.]]) in 2010, "[[Company:Gartner|Gartner]]'s expectation is that the hardware [[One-time password|OTP]] form factor will continue to enjoy modest growth while [[Engineering:Smartphone|smartphone]] OTPs will grow and become the default hardware platform over time."<ref name="gartnerotprm"/>

==See also==
* Initiative For Open Authentication
* S/KEY
* [[Time-based One-time Password algorithm]]

== References ==
{{Reflist|30em}}

==External links==
* [http://www.ietf.org/rfc/rfc4226.txt RFC4226: HOTP: An HMAC-Based One-Time Password Algorithm]
* [https://tools.ietf.org/html/rfc6287 RFC 6287: OCRA: An HMAC-Based OATH Challenge-Response Algorithm]
* [http://www.openauthentication.org/ Initiative For Open Authentication]
* [https://nbviewer.jupyter.org/github/algorithmic-space/cryptoy/blob/master/rfc4226.ipynb Step by step Python implementation in a Jupyter Notebook]

{{DEFAULTSORT:Hotp}}
[[Category:Internet protocols]]
[[Category:Cryptographic algorithms]]
[[Category:Computer access control protocols]]

{{Sourceattribution|HMAC-based One-time Password algorithm|1}}