Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation server; encrypting the seed using a passphrase or a PIN is a solution. My question is if there is another methods to ensure the security of the OTP seed ?

Thanks in advance. Have a nice day.

share|improve this question

1 Answer 1

Your title asks about storing data. The body of your question asks about transmitting data. The purpose of a one time password is to only use a password once. They do not need to be protected, but that's assuming the network is safe which is a matter of cryptographic authentication or a matter of trust in the network.

Entering secret data defeats the purpose of one time passwords. Since pins are so short you could reverse the encryption by brute force. Your description is so vague, I am certain there are be various other problems in the scheme as you understand it.

I beleive Wikipedia has multiple concise articles about different one time password algorithms.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.