Is the Lamport OTP algorithm different from HOTP and TOTP? How similar or different are they?

  • a wiki search returns the different algorithms - have you done some research?
    – schroeder
    Commented Jun 5, 2015 at 4:57

2 Answers 2


HOTP and TOTP are similar. Lamport OTP is different.

A HOTP is an HMAC of a shared secret and a counter. For example, on your Nth login you would use HMAC(SHARED SECRET, N). This provides strong security but can suffer from the counters between the client and the server becoming out of sync. It also has the problem that the next HOTP is long-lived. That is, it is valid until it is used. This may allow an attacker considerable time to try to guess it.

A TOTP is an HMAC of a shared secret and the current time. For our discussion we'll assume that the password changes every 60 seconds. As an example, a login that occurs on 2015-06-05 05:33 GMT, you would use HMAC(SHARED SECRET, 201506050533). Unlike the HOTP, there is no counter to get out of sync (it is fair to assume that clocks are synchronized within a few seconds of each other). Also, each password only lasts for one minute so an attacker who is trying to guess the TOTP must find it within 60 seconds or they must begin their guessing again.

A Lamport OTP is a bit different than HOTPs and TOTPs. A Lamport OTP does not require a shared secret. Lamport OTP's are used for validating a series of successive logins. For our example, let's assume we have a hash function H (pick your favorite). Lamport OTPs have the property that the Nth OTP, written OTP(N) is H(OTP(N+1)). This means that if the server remembers that the last OTP was X, when it receives the next OTP Y, it can validate it is correct by ensuring that X equals H(Y). If it is correct, the server will allow the login and store Y for use in the next login. The server gets the initial OTP from the client when the client logs in the first time.

On the client end, the client begins by choosing a seed value. It then calculates H(SEED), H(H(SEED)), ... Let's say for 1000 iterations. It stores the entire sequence. When it first logs into the server it passes it the 1000th value. The next time it passes it the 999th value and so on. Because hash algorithms are not easily reversible, an observer who sees any specific OTP cannot calculate the next OTP as that would require them reversing the hash.

When the chain of Lamport OTPs runs out (eg: after the 1000 are used), the client must create a new seed, calculate a new chain, and pass the server the new last value. While it is not a requirement of Lamport OTPs, one could imagine that a login that is passing the new last value of a chain would require 2-factor authentication while logins that are using the next Lamport OTP require only 1-factor.

While all of these have the word "password" in their name, they can be used for purposes other than logins. For example, this article describes using Lamport OTPs for authenticating successive messages in a conversation.

  • Thank you much. Exactly the sort of explanation I needed. Commented Jun 5, 2015 at 5:33
  • @Neil, Is Lamport OTP even used at all in the real world? It seems like something that just exist in the classroom.
    – Pacerier
    Commented Nov 25, 2015 at 3:17
  • Sorry @pacerier bit I don't know. I can't think of any use that I've heard of. Commented Nov 25, 2015 at 3:34
  • @pacerier lamport was used but imho it is not anymore
    – cornelinux
    Commented Mar 6, 2017 at 22:00

I think there is a conceptional difference between lamport OTP and OATH HOTP/TOTP.

Take a look at RFC1938 which you probalby ment when referring to Lamport OTP. It was published in 1996 and is based on [1]

[1] Leslie Lamport, "Password Authentication with Insecure Communication", Communications of the ACM 24.11 (November 1981), 770-772

There are actually tools to calculate such OTP values "OUST COAT FOAL MUG BEAK TOTE" and to login like, lets say SSH. I experimented with that several years ago. Such an OTP value is calculated based on the iteration number and a password you enter for calculating the OTP value.

HOTP/TOTP (RFC4226) is calculated based on a secret key - usually stored in hardware. At least all participanting writers of RFC4226 are... ...hardware vendors.

To my understanding Lamport OTP and OATH HOTP/TOTP have totally different goals. Although SSL 1.0 was published in 1994, the RFC number for SSL is 2246 which is signigicantly higher than 1938 ;-) The goal of Lamport OTP was to avoid password replay attacks over insecure connections! Also see the abstarct of RFC 1936.

In contrast HOTP/TOTP is ment to introduce a second factor for authentcation, where the secret key was originally stored in offline hardware. Lamport OTP generated the OTP based on one factor "passphrase" and was only ment to avoid sending the password over the wire.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .