I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage).
Now I searched a bit around and found no satisfying answer to the question:
- Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?
- If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password usually move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?
As a side note: I do not include OTP tokens made specifically for large companies, because obviously they'd be manufactured with a company-known secret / customized from the company.
As a side note: If the token has a display (like a RSA SecurID), the user can simply read the OTP and enter it manually using the keyboard and if it features a direct USB connection (like a YubiKey) the token can just emulate a keyboard and type it by itself.