How do hardware OTPs work - from a developer's perspective?

Question

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage).

Now I searched a bit around and found no satisfying answer to the question:

• Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?
• If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password usually move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?

As a side note: I do not include OTP tokens made specifically for large companies, because obviously they'd be manufactured with a company-known secret / customized from the company.

As a side note: If the token has a display (like a RSA SecurID), the user can simply read the OTP and enter it manually using the keyboard and if it features a direct USB connection (like a YubiKey) the token can just emulate a keyboard and type it by itself.

Answer 1

You may be interested in reading:

• HOTP: An HMAC-Based One-Time Password Algorithm (RFC 4226)
• TOTP: Time-Based One-Time Password Algorithm (RFC 6238)

Both of them describe standard ways of creating a One-Time Password.

Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?

There are two options here:

• The OTP token is specific to your application, either you manufacture your own hardware token, flash with your own secret a token made by others or bought the token to a manufacturer (which would provide you a file with the secret keys for your token(s)), in which case no communication with the manufacturer is needed during operation.

However, if the manufacturer provides the OTP token as a service for multiple entities (like YubiCloud), then yes, the application would need to ask every time to the manufacturer server if the given OTP token is valid.

Suppose you had a way to verify tokens without a central registry, perhaps because the token has an embedded signature you can check with a public key associated to the device). Then, when you attempt to login into website A, it could copy your token and impersonate you with it in website B.

(U2F is designed to avoid this problem by including a challenge, but it is no longer a simple OTP token)

If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?

The smartcard would usually be moved to the user through a USB card reader, although any device bringing the gap -such as the card reader with an independent screen you suggest- would actually work.

Answer 2

As stated in your other post:

No. You do not need to pass the OTP value to the manufacturers site. Usually - if you are buying pure OATH/HOTP tokens cheap in china (like Feitian), you will not even be able to do this. You need to run your own server like privacyIDEA.

The smartcard is usually no OTP token. However, some smartcards like from Gemalto indeed have an OTP application on it. In this case you need to insert the smartcard into a smartcard reader and you need to have an additional application on your client. This application will communicate with the smartcard to retrieve the OTP value.