HOTP
acronymsecuritycryptography
Stands for: HMAC-based One-Time Password
A one-time code advanced by a counter rather than a clock.
HMAC-based One-Time Password (RFC 4226) derives codes from a shared secret and an incrementing counter. TOTP is HOTP with the counter replaced by time; HOTP itself is used where a counter is easier to synchronize than a clock.
HOTP generates one-time codes from a shared secret and a counter that advances with each use, which is the design TOTP later adapted by substituting time for the counter. The counter version is what physical hardware tokens with a button use, since a device with no clock cannot compute a time-based code.
The counter is also the source of the one operational quirk. Because the device advances its counter whenever the button is pressed and the server advances only on successful validation, the two drift apart when a user generates codes they never submit. Servers therefore accept a window of upcoming counter values and resynchronize when they find a match further ahead, and a token that has drifted beyond that window needs explicit resynchronization rather than replacement.
The security comparison with TOTP is genuinely nuanced. A HOTP code stays valid until it is used, which is more forgiving for a user typing slowly and a longer window for anyone who intercepts it. A TOTP code expires in thirty seconds regardless. Neither resists real-time phishing, because both rely on the user handing the code over, which is the gap that origin-verifying hardware keys close.
Also known as: hotp