glacasa/TwoStepsAuthenticator — pull request #4 by dusk0r (2013-12-06 16:12:00+00:00)
Title: UsedCodesManager removed for HOTP

I guess Timestamp / Code pairs are ok. The don't reveal any secrets and can't be used again.

However, if two users generate the same code in the same time window (default 30s) the later one will be rejected (until a new time window). Maybe we should throw an exception so the programmer can resolve this situation. What do you think?

RFC says:
We also RECOMMEND storing the keys securely in the validation system,
and, more specifically, encrypting them using tamper-resistant
hardware encryption and exposing them only when required: for
example, the key is decrypted when needed to verify an OTP value, and
re-encrypted immediately to limit exposure in the RAM to a short
period of time.

and
Note that a prover may send the same OTP inside a given time-step
window multiple times to a verifier. The verifier MUST NOT accept
the second attempt of the OTP after the successful validation has
been issued for the first OTP, which ensures one-time only use of an
OTP.