RFC - 4226

HOTP: An HMAC-Based One-Time Password Algorithm

Original:	ftp://ftp.isi.edu/in-notes/rfc4226.txt
Authors:	M. Bellare [UCSD], F. Hoornaert [Vasco], D. Naccache [Gemplus], O. Ranen [Aladdin]
Date:	December 2005
Category:	Informational

---

Referred by:	1 RFC
Refers to:	4 RFC

---

Status

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Copyright Notice

Copyright (C) The Internet Society (2005).

Abstract

This document describes an algorithm to generate one-time password values, based on Hashed Message Authentication Code (HMAC). A security analysis of the algorithm is presented, and important parameters related to the secure deployment of the algorithm are discussed. The proposed algorithm can be used across a wide range of network applications ranging from remote Virtual Private Network (VPN) access, Wi-Fi network logon to transaction-oriented Web applications.

This work is a joint effort by the OATH (Open AuTHentication) membership to specify an algorithm that can be freely distributed to the technical community. The authors believe that a common and shared algorithm will facilitate adoption of two-factor authentication on the Internet by enabling interoperability across commercial and open-source implementations.

---