This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here.
We are trying to implement a hmac-based one time password protocol for use authenticating users over our api.
The idea is to encrypt a unique identifier for the user (uid) against a private key and an incremental counter. Then increment the counter for the next call.
encrypt(uid, private_key, counter) # now increment the counter for the next call
Then on the server side, decrypt using the private key and the counter to get the user identifier (uid).
decrypt(encrpyted_string, private_key, counter) # now increment the counter for the next received request
This works fine. Each call is completely unique (one time) because of the counter.
However how would we handle synchronisation of the counter? What happens if the client generates a request, increments the counter for the next call, and sends the request, but the server is offline and never receives the request, or there is an internet connectivity issue and the request never gets through - now the server and the client are out of sync with each other's counters.
Is this a case of "you should know if a request has been submitted"? I.e. we could add a response header from the server to say whether the counter has been incremented and only if it has do we increment the counter in the app too... but then the same could be said the other way around - we could send a request, the server receives it, increments its own counter and sends a response, but the internet connection has been interrupted whilst the server was processing its request and the app never receives the response, never increments its counter and therefore the two are out of sync again.
Thanks for any insight you can give me.