One-Time Password System with Infinite Nested Hash Chains

• Published in: Security Technology, Disaster Recovery and Business Continuity Vol. 122; pp. 161 - 170
• Main Authors: Eldefrawy, Mohamed Hamdy, Khan, Muhammad Khurram, Alghathbar, Khaled
• Format: Book Chapter
• Language: English
• Published: Germany Springer Berlin / Heidelberg 2010; Springer Berlin Heidelberg
• Series: Communications in Computer and Information Science
• Subjects: Authentication’s Factors; Lamport Hashing; Nested Hash Chains; One Time Password
• ISBN: 3642176097; 9783642176098
• ISSN: 1865-0929; 1865-0937
• DOI: 10.1007/978-3-642-17610-4_18

Hash chains have been used as OTP generators. Lamport hashes have an intensive computation cost and a chain length restriction. A solution for signature chains addressed this by involving public key techniques, which increased the average computation cost. Although a later idea reduced the user computation by sharing it with the host, it couldn’t overcome the length limitation. The scheme proposed by Chefranov to eliminate the length restriction had a deficiency in the communication cost overhead. We here present an algorithm that overcomes all of these shortcomings by involving two different nested hash chains: one dedicated to seed updating and the other used for OTP production. Our algorithm provides forward and non-restricted OTP generation. We propose a random challenge–response operation mode. We analyze our proposal from the viewpoint of security and performance compared with the other algorithms.