Subject: [KEYPROV] SHOTP = Counter[8] || HmacSha1 (SecretKey, Counter[8])

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 22 Oct 2008 16:02:44 +0200

What is SHOTP?
It is Super HOTP.

Compared to the original (truncating) HOTP algorithm SHOTP offers:

- Approx. 1000000000000000000000000000000000000 times the cryptographic strength
- No need for auth protocol sync events due to: Counter inclusion + Strength
- No need for account lockup after 3-5 bad tries (trivial OTP DoS attack)
- Compatible with HTTP Basic Authentication "as is"
- Simple client API: getSHOTP ()

Use-cases:  All OTP-using applications except for the traditional manual inputting of OTPs.

Is this a new algorithm?  Not really, so I made it a sub-feature of HOTP in the KeyGen2 HOTP 
profile.
Presumable the same could apply to KEYPROV if there is an interest using stronger OTPs.

The counter inclusion thing was taken from this document
http://www.oasis-open.org/committees/download.php/15085/rsa-otps-otp-wss-token-v1-0.pdf
while the throwing away of crypto bits always felt like a silly solution for programmatic OTP usage.

Anders R
http://WebPKI.org

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov