Which one-time password method uses a shared secret and the current time to generate codes?

• A. HOTP
• B. Time-Based On-Time Password (TOTP)
• C. In-Band Authentication
• D. Out-of-Band Authentication

Answer: (B)

Time-Based One-Time Passwords use a shared secret and the current time to generate codes. In this method, both the authenticator (the device you use) and the server know a secret key. They also agree on a time step (for example, 30 seconds). At any given moment, both sides take the secret and the current time, convert the time into a counter by dividing the current time by the time step, and run that data through a cryptographic function (often an HMAC). The result is a short numeric code that changes every time step. Because the code depends on the exact time, it expires quickly, which improves security.

HOTP, in contrast, uses a counter that increments with each authentication attempt, not the clock. In-Band and Out-of-Band Authentication describe the channel used to perform or convey authentication information rather than how the one-time password itself is generated. So the method that matches the description—shared secret plus current time—is Time-Based One-Time Password.