3 ms·
The general assumption in cryptography that the algorithm used for encryption is known. Even if you relax that restriction and assume you know which algorithms
by DasIch 12y ago
The general assumption in cryptography that the algorithm used for encryption is known. Even if you relax that restriction and assume you know which algorithms a user can choose but not which one she chose, you could still just try all of them, if they are "not too complicated".
- esrauch 12y agoIf 3 login attempts invalidate the OTP then you only need a manageable number of different "known modifications" to tell the user through the secure channel to keep this safe. If they can arbitrary brute force you OTP anyway then the OTP isn't really going to be all that useful at 10k possibilities. That said, hardly any user would be willing to take on such complexity without very strong reason.