I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the otp-generator-app should work on one or more mobile devices.
Currently I am thinking about using a secure Pseudo Random Number Generator. The generated number will be displayed on the "server". Then the user has to enter this number into the mobile devices. The generator uses the input random number and a pre-shared secret, links them together, and hashes them several times. The result is the OTP.
Is there a similarly standardized way to generate an OTP?
I have a server with a login to a secret area. On the other hand I have different mobile devices that maybe able to login in the same secret area. So there are many devices that have to be synchronized before each login.
In the HOTP there two possible kinds of shared secrets: Random Generation and Deterministic Generation.
In my opinion the random generation is not possible because of the multiple mobile devices for the same login. I can think of no solution as synchronizing the secure prng like the HMAC_DRGB or other.
With Deterministic Generation, the master secret is only stored on the server. I am not able to find a way to share the shared secret securely with only a display.
So that's the reason why I'm looking for other standards to generate a OTP...
Or is there any way to store the secret securely on the server and the clients?