Question

Is it possible to use TOTP to generate tokens from multiple channels (where a channel is defined as a "user" using a certain shared key K_c for channel c), and in so doing identify the channel itself from the OTP?

For example, if two OTP's were generated with the both time sequence constant i_0, and shared secret keys K_1 and K_2 respectively, then:

A = HMAC-SHA-1(K_1, i_0) and B = HMAC-SHA-1(K_2, i_0)

where A and B are the OTP's generated. My question is: would it be possible on the server side during validation to establish without the shadow of a doubt (mathematically speaking) that A is "linked" to channel 1 (K_1), and B to channel 2? In other words, every OTP generated using K_1 will be different to those OTP's generated using K_2 regardless of the truncation of the 160-bit output of HMAC.

My second question would be that if this is the case (the two "sequences" are different), can their difference be quantified in terms of say a Hamming distance?

No correct solution

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top