I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation server; encrypting the seed using a passphrase or a PIN is a solution. My question is if there is another methods to ensure the security of the OTP seed ?

Thanks in advance. Have a nice day.

1 Answer 1


Your title asks about storing data. The body of your question asks about transmitting data. The purpose of a one time password is to only use a password once. They do not need to be protected, but that's assuming the network is safe which is a matter of cryptographic authentication or a matter of trust in the network.

Entering secret data defeats the purpose of one time passwords. Since pins are so short you could reverse the encryption by brute force. Your description is so vague, I am certain there are be various other problems in the scheme as you understand it.

I beleive Wikipedia has multiple concise articles about different one time password algorithms.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .