Which one-time password method uses a shared secret and a counter to generate codes instead of time?

• A. In-Band Authentication
• B. HOTP
• C. TOTP
• D. Out-of-Band Authentication

Answer: (B)

The concept tested is event-based one-time passwords, where the code is derived from a shared secret and a counter. This method, HOTP, uses the secret plus a counter that increments with each authentication. Both the client and server hold the same secret and keep the same counter value, and the code is produced by applying an HMAC to the secret and the counter, then truncating to a numeric code. Because both sides compute the same value, the server can verify the login by checking the HOTP generated from the expected counter.

This differs from time-based OTPs, which derive the code from the current time rather than a counter, so the code changes with time steps. The other options describe how the authentication message is delivered (in-band vs out-of-band) rather than how the OTP itself is generated, or they refer to the time-based approach rather than the counter-based approach. Thus, HOTP is the method that uses a shared secret and a counter to generate codes instead of time.