TechKnowSurge
CompTIA Security+ 1.4 CompTIA Security+ 4.6 NIST 800-53 IA-5
TechKnowSurge Catalog Interactives Will the Code Work?
InteractiveSecurityFree

Will the Code Work?

A fob that ran ahead, a clock that is off, a key that changed, a phone with no signal. Predict what happens to each one-time code.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

A texted code is made on the server and sent to the phone, so it needs a signal to arrive. An authenticator app or a fob is different: nothing is sent. The device and the server each work the code out for themselves, by hashing a shared key, exchanged once by typing it in or scanning a QR code, with a moving value. HOTP moves its value with a counter. Each new code steps the device's counter on, and the server steps its own only when a code is used. Codes made and never used put the device ahead, so the server looks a few counts ahead for a match, and when it finds one it moves its own counter up to match. Too far ahead, and the device has to be brought back in step. TOTP moves its value with the clock, in thirty-second steps. If the phone's clock and the server's disagree, the codes stop matching, so the server also accepts codes from a step or so either side of its own: the tolerance window. A clock off by more than the window fails, whichever side is wrong. The key decides the rest. Two devices holding the same key show the same code; a new key, or one wrong character, and the codes stop matching. Anyone who steals the key can make the codes too, and anyone who sees one code without the key learns nothing about the next.

What you'll learn

Aligned to

CompTIA Security+
1.4 Explain the importance of using appropriate cryptographic solutions.
4.6 Given a scenario, implement and maintain identity and access management.
NIST 800-53
IA-5 Authenticator Management

Key terms

HMAC-based One-time Password
HOTP
HMAC-based One-time Password is an algorithm that generates a one-time code using HMAC-SHA1 and a counter value, used in hardware tokens for multi-factor authentication.
Time-based One-time Password
TOTP
Time-based One-time Password generates short-lived authentication codes using HMAC and the current Unix time, widely used in authenticator apps as a second factor.
Look-Ahead Window
A configurable tolerance in HOTP that allows the server to check a range of future counter values to compensate for counter drift.
Clock Skew
A time synchronization problem in TOTP where slight differences between the client and server system clocks can cause generated codes to not match.
Counter Drift
A synchronization problem in HOTP where the client counter advances without a corresponding login, causing the client and server counters to fall out of sync.
Shared Secret Key
A cryptographic key known only to the authenticator app and the server, used as a common input to generate matching one-time passwords.

Topics

Authentication One Time Password Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →