I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm.
I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g. five hours), but each code can only be used once.
HOTP and TOTP basically work the same way, the difference is that for HOTP, the message for the HMAC algorithm is a counter and for TOTP it is a (unix) timestamp. For popular implementations like Google Authenticator, the message is 8 bytes long.
A possible solution would be to create a message, that contains the concatenated counter and timestamp, therefore creating a message larger than 8 bytes. The timestamp can then be used multiple times, because the counter will be incremented.
Is this a valid approach? Are there security risks?