OTP Cryptography Internals
HOTP and TOTP from the RFCs up: shared secrets, HMAC, dynamic truncation, time steps, secret provisioning and the verification policy that keeps a six-digit code honest.
Chapters
- 1
Shared secrets and the one-time property
What a one-time password actually proves, why both sides must hold the same key, and where the “one-time” guarantee really comes from.
6 min read
- 2
HOTP from the RFC: counter, HMAC-SHA1, dynamic truncation
Walk RFC 4226 byte by byte: encode the counter, compute the HMAC, pick the offset, extract 31 bits and reduce to six digits.
6 min read
- 3
TOTP: time steps, clock skew and drift windows
Turn wall-clock time into a counter, then decide how much disagreement between two clocks your verifier should forgive.
6 min read
- 4
Secrets: generation, base32, entropy budget and provisioning URIs
Generate seeds that deserve the name, encode them for humans and QR codes, and build otpauth URIs that every authenticator parses the same way.
6 min read
- 5
Verification policy: ±1 windows, resync counters, replay caches
Turn a stateless code check into a verifier that is one-time, rate-limited, drift-aware and safe under concurrency.
6 min read