HOTP: An HMAC-Based One-Time Password Algorithm

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 37
Abstract: This document describes an algorithm to generate one-time password values, based on Hashed Message Authentication Code (HMAC). A security analysis of the algorithm is presented, and important parameters related to the secure deployment of the algorithm are discussed. The proposed algorithm can be used across a wide range of network applications ranging from remote Virtual Private Network (VPN) access, Wi-Fi network logon to transaction-oriented Web applications. This work is a joint effort by the OATH (Open AuTHentication) membership to specify an algorithm that can be freely distributed to the technical community. The authors believe that a common and shared algorithm will facilitate adoption of two-factor authentication on the Internet by enabling interoperability across commercial and open-source implementations. This memo provides information for the Internet community.
Publication Date: 2005-12-01
Status Note: Informational
DOI: 10.17487/RFC4226
Link: https://doi.org/10.17487/RFC4226
Author(s): David M'Raihi
Mihir Bellare
Frank Hoornaert
David Naccache
Ohad Ranen
Keyword(s): HMAC, OATH, Open Authentication, Authentication

Latest version of IETF RFC 4226

Document Versions — IETF RFC 4226

▶ IETF RFC 4226 (2005-12-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

10.5555-646761.706031 — BCK1 EXTERNAL
IETF RFC 2104 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 3979 [Superseded*]
IETF RFC 4086 [Active*]

Bibliographic Reference(s)

10.5555-646760.705865 — PV EXTERNAL
How to Share a Secret, by Adi Shamir. In Communications of the ACM, Vol. 22, No. 11, pp. 612-613, November, 1979. EXTERNAL
Bruce Schneier. SHA-1 broken. February 15, 2005. http://www.schneier.com/blog/archives/2005/02/ sha1_broken.html EXTERNAL
Initiative for Open AuTHentication http://www.openauthentication.org EXTERNAL
Crack in SHA-1 code 'stuns' security gurus http://www.eetimes.com/showArticle.jhtml? articleID=60402150 EXTERNAL
Researchers: Digital encryption standard flawed http://news.com.com/ Researchers+Digital+encryption+standard+flawed/ 2100-1002-5579881.html?part=dht&tag=ntop&tag=nl.e703 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC4226.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm. Available at https://doi.org/10.17487/RFC4226

Snippet:

IETF RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm. Available at https://doi.org/10.17487/RFC4226

HTML (ISO 690 compliant)

Preview:

IETF RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm. Available at https://doi.org/10.17487/RFC4226

Snippet:

<span class="citation"><cite>IETF RFC 4226</cite>, HOTP: An HMAC-Based One-Time Password Algorithm. Available at <a href="https://doi.org/10.17487/RFC4226" target="_blank" rel="noopener">https://doi.org/10.17487/RFC4226</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm
doi: 10.17487/RFC4226
url: https://doi.org/10.17487/RFC4226

Snippet:

<li>
<cite id="bib-rfc4226">IETF RFC 4226</cite>, HOTP: An HMAC-Based One-Time Password Algorithm
<span class="doi">10.17487/RFC4226</span>
</li>

Referenced By

IETF RFC 4449 [Active*]
IETF RFC 6030 [Active*]
IETF RFC 6150 [Active*]
IETF RFC 6238 [Active*]