How does an OTP solution work?
A. There are two main categories of OTP solutions: time-based or event-based. In both cases, the smart token and the validation server are sharing a same secret. In the case of time-based OTP, the smart token has its own internal clock. The validation server also has a clock that maintains the current time. When the server receives a password, it independently takes the current time, combines it with the secret key, and performs the same cryptographic computation as the token. If the password received from the token matches the password generated by the server itself, access is granted. In the case of event-based OTP, the smart token and the validation server are using the same counter. When the server receives a password, it independently takes the current counter value, combines it with the secret key, and performs the same cryptographic computation as the token. If the password received from the token matches the password generated by the server itself, access is granted.
