HMAC-based one-time password

At setup time a client and server share a secret and other initialization settings. In future exchanges when a client attempts to access a server a challenge is sent from the server to the client and the client then uses the previously exchanged secret and computes a value (a one time password) to be used as the server's challenge response. HOTP was published as an informational IETF RFC 4226 in December 2005, documenting the algorithm along with a Java implementation. Since then, the algorithm has been adopted by many companies worldwide (see below). The HOTP algorithm provides a method of authentication by symmetric generation of human-readable passwords, or values, each used for only one authentication attempt. The one-time property follows directly from the single use of each counter value. Parties intending to use HOTP must establish some initial parameters, which are typically specified by the authenticator, and either accepted or not by the authenticated entity: Both parties compute the HOTP value derived from the secret key K and the counter C. Then the authenticator checks its locally generated value against the value supplied by the authenticated. The authenticator and the authenticated entity increment the counter C independently.