Is there a one time password generation algorithm (based on predefined secret and a changing value/time/counter/etc) that is simple enough that it can be processed by an average human but safe enough that the secret cannot be found with just a few passwords (say 5-10)?
I have seen questions on various specific password schemes and how secure they are. But I'd like to know more generally whether some well-know algorithms exist.
Intuition tells me, that if something is easy enough to be processed by a human, then its also easy to break. But then again I was very surprised that asymmetric encryption is possible, or secure key exchange (DH). So, surprise me!
Edit: Some clarification.
The question came up when I was pondering about two-factor authentication for outdoor use. A typical two-factor authentication for safe environments (home, office, ...) uses a password and an OTP generator in a device or on your phone. You loose the device/phone, there's still the password. A keylogger steals your password, there's still the device/phone.
But what about situations where both could be stolen? For example, you use an app to pick up an e-bike on the street or to open a locker in a train station. Someone might watch while you enter the password on your phone and later also steal the phone itself.
The problem could be solved by using passwords that become useless within a short time frame (eg. 10min). In addition the phone would have an individual secret (e.g. SSL client certificate) to make brute-force attacks against the password authentication harder.
mr.spuratic's suggestion around Blum's HCMU algorithm is pretty close to what I was looking for. It still looks a little too heavy weight for the average human, but with some practicing it would be feasible.