I want to build a custom OTP implementation that utilizes the HOTP/TOTP algorithm.

I need to create several codes (one time passwords), which are all valid for the same time window in the future (e.g. five hours), but each code can only be used once.

HOTP and TOTP basically work the same way, the difference is that for HOTP, the message for the HMAC algorithm is a counter and for TOTP it is a (unix) timestamp. For popular implementations like Google Authenticator, the message is 8 bytes long.

A possible solution would be to create a message, that contains the concatenated counter and timestamp, therefore creating a message larger than 8 bytes. The timestamp can then be used multiple times, because the counter will be incremented.

Is this a valid approach? Are there security risks?

| improve this question | | | | |
  • Is this related to your other question?security.stackexchange.com/questions/221093/… – schroeder Mar 2 at 16:12
  • My question here is the same as there. Why not track the usage of the issued codes? Don't encode control logic within the code, create a database with the time window. – schroeder Mar 2 at 16:15
  • @schroeder, yes, it is related. The difference is, that I know that I want to use HOTP/TOTP and have a possible solution. I would have had to edit the previous question too much, I think. And my answer is the same, if I understand your suggestion as you intended: I need to create several codes in advance for a specific time window (not 30s, but e.g. 5h). With TOTP, only one code would be valid in that window. Therefore the need of a counter. TY & BR – earthling Mar 3 at 7:25
  • No... that's not what I said ... When you issue a code to a user, you create an entry in the database for the time period it is valid for ... And you said that you wanted several codes valid for the same time window. Has your requirement changed? Alternatively, you can specify in the user database when any code generated on their side would be valid "can only use codes during X and Y". – schroeder Mar 3 at 7:32
  • This is starting to look like an X/Y situation. You are focused on xOTP as a solution, but I'm not sure you're approachign the problem correctly – schroeder Mar 3 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.