T/Key: Second-Factor Authentication From Secure Hash Chains

Dmitry Kogan, Nathan Manohar, Dan Boneh

Time-based one-time password (TOTP) systems in use today require storing secrets on both the client and the server. As a result, an attack on the server can expose all second facto…