2005·mfa·RFC 4226
Legacy
HOTP
OTP на основе счётчика. Прародитель Google Authenticator.
Плюсы
- +Простой алгоритм
Минусы
- −Counter-drift
- −Заменён TOTP
HOTP (counter)
- 1.Client device ↺ Client devicemac = HMAC-SHA1(secret, counter)
- 2.Client device ↺ Client devicetruncate → 6 digits
- 3.Client device → ServerPOST /verify { code }
- 4.Server ↺ Servermac for counter, counter+1, … counter+w
- 5.Server ↺ Servermatch? advance counter
- 6.Server → Client deviceok
HOTP (RFC 4226)
Network · DevTools